CVE-2022-40497: Wazuh

High severity, CVSS 8.8. EPSS: 1.6% chance of exploitation in the next 30 days.

Wazuh v3.6.1 - v3.13.5, v4.0.0 - v4.2.7, and v4.3.0 - v4.3.7 were discovered to contain an authenticated remote code execution (RCE) vulnerability via the Active Response endpoint.

Affected products

• Wazuh Wazuh: from 3.6.1, up to and including 3.13.5; from 4.0.0, up to and including 4.2.7; from 4.3.0, up to and including 4.3.7

Published 2022-09-28. Last modified 2026-06-17.