High · published November 22, 2025
🚨 A crafty UNC path can trigger NTLM authentication in Wazuh Agent, and that’s a gateway to privilege escalation and remote code execution! ⚡ Think of it like an unsuspecting delivery driver being tricked into delivering confidential packages to the wrong address — once the driver believes they're at the right place, it's game over! If an attacker exploits this vulnerability, they could gain elevated privileges and execute arbitrary code on your system, potentially compromising sensitive data and systems. This could lead to an absolute nightmare scenario for your organization!
Think of it like an unsuspecting delivery driver being tricked into delivering confidential packages to the wrong address — once the driver believes they're at the right place, it's game over! This vulnerability stems from Wazuh Agent's failure to properly handle malicious UNC paths, allowing authenticated attackers to force NTLM authentication and execute NTLM relay attacks, paving the way for privilege escalation and remote code execution.
If an attacker exploits this vulnerability, they could gain elevated privileges and execute arbitrary code on your system, potentially compromising sensitive data and systems. This could lead to an absolute nightmare scenario for your organization! Upgrade your Wazuh Agent to version 4.13.0 or later to close this loophole. Ensure that your configurations do not allow the use of malicious UNC paths and educate your users about the dangers of such exploitation. You’ve got this! Stay vigilant and secure your systems, and you'll keep the digital baddies at bay! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| wazuh/wazuh | < 4.13.0 | 4.13.0 |