CVE-2025-64483 Wazuh API – Agent Configuration Has Improper Access Control in Agent Enrollment Endpoint
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2025-64483?
CVE-2025-64483 is a medium-severity vulnerability in wazuh-dashboard-plugins, published on 21 Nov 2025.
Official description
Wazuh is a security detection, visibility, and compliance open source project. From version 4.9.0 to before 4.13.0, the Wazuh API – Agent Configuration in certain configurations allows authenticated users with read-only API roles to retrieve agent enrollment credentials through the /utils/configuration endpoint. These credentials can be used to register new agents within the same Wazuh tenant without requiring elevated permissions through the UI. This issue has been patched in version 4.13.0.
Weakness: CWE-284
Which versions are affected by CVE-2025-64483?
How do I fix CVE-2025-64483?
No fix has been published for CVE-2025-64483 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-64483 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-64483 exists.
Sources
Also known as GHSA-gwf3-8gm3-qrmj.