Wazuh versions 4.0.0 through 4.14.2 contain a Remote Code Execution (RCE) vulnerability caused by deserialization of untrusted data (CWE-502). An attacker who obtains any access to a worker node can execute arbitrary code with root privileges on the master node, compromising the entire cluster.

The affected product is Wazuh, specifically deployments using the cluster mode (master/worker architecture). All versions from 4.0.0 up to and including 4.14.2 are impacted; version 4.14.3 and later contain the fix.

This vulnerability has a CVSS score of 9.1, indicating a high severity. The EPSS score is below 1%, suggesting a low current probability of exploitation, and it is not listed in CISA's KEV catalog. The attack requires initial compromise of a worker node; once achieved, the attacker can leverage the insecure deserialization to achieve full RCE on the master node with root-level access. The high impact combined with the need for worker node access makes it a significant threat to clusters with insufficient isolation or hardening, especially those exposed to the internet or with sparse network segmentation.