Wazuh 4.14.8 fixes 15 vulnerabilities including root RCE

Wazuh 4.14.8 patches fifteen vulnerabilities, including two rated CVSS 9.4 that permit remote code execution with root privileges on the manager. The securityonline.info advisory notes the fix version explicitly and flags root-level impact, but lists no CVE identifiers and does not distinguish whether authentication is required for either critical path. That omission matters: if the RCE is unauthenticated, any exposed Wazuh manager is a direct host compromise; if it requires a valid session, exposure shrinks to compromised credentials or insider access, which changes the urgency profile.

A security platform running with root privileges that also processes telemetry and agent data makes this more dangerous than a typical application RCE. Successful exploitation does not just yield a shell; it hands the attacker the monitoring backbone itself, allowing suppression of alerts, pivoting through agent connections, and persistence inside the security layer. The event carries no telemetry counts or active exploitation markers, so this post treats the fifteen fixes as a preemptive hardening event rather than a confirmed-in-the-wild campaign, but the 9.4 score and root context justify treating 4.14.8 as an emergency patch regardless of current noise.

Upgrade to Wazuh 4.14.8 immediately; there is no mentioned workaround or hotfix version besides the release itself. After patching, hunt manager logs for anomalous API or agent-registration events around the exposure window, and restrict manager interfaces to administrative networks only. Confirm whether future vendor releases assign CVEs to the two 9.4 flaws; without them, tracking in vulnerability scanners depends on manual mapping and increases the risk that a follow-on patch is missed.