Wazuh versions 4.0.0 up to but not including 4.14.9 contain a SQL injection vulnerability in the WazuhDBBackend._substitute_params function. Authenticated users with agent:read permission on one agent can exploit this flaw by injecting UNION SELECT statements via the q and search parameters. This allows extraction of internal keys of all agents through a blind boolean oracle technique. The vulnerability is fixed in version 4.14.9.
Wazuh dashboard plugins from 4.9.0 before 4.14.9 contain an authorization bypass vulnerability that allows authenticated dashboard users to override the Manager API Authorization header via the /api/request proxy endpoint. Attackers can supply nested body.headers.Authorization values that replace the server-side session Bearer token, letting them act as another Manager API identity or send unauthenticated upstream requests.
Wazuh versions from 3.9.0 up to but not including 4.14.9 have a vulnerability in the fluent-forward module where TLS hostname verification is missing. This flaw allows network attackers who can redirect connections via DNS, ARP, or on-path attacks to impersonate the Fluentd collector by presenting any certificate chaining to the configured CA file. Exploiting this vulnerability enables attackers to intercept forwarded security telemetry and obtain the shared key hash for offline cracking.
Wazuh from 4.3.0 before 4.14.9 contains a server-side request forgery vulnerability in the GitHub module (wm_github.c) that trusts unvalidated Link rel="next" pagination URLs. Attackers controlling the next-page URL can make the manager send requests with the GitHub API token to attacker hosts, exposing organization repositories and settings.
Wazuh versions from 3.7.0 up to but not including 4.14.9 contain a server-side request forgery (SSRF) vulnerability in the Azure wodle get_graph_events() function. This function follows the @odata.nextLink URL without validating the host or HTTPS scheme. An attacker who can influence the nextLink value may redirect requests to attacker-controlled endpoints, potentially capturing the Microsoft Graph bearer token and accessing internal services. The vulnerability has a CVSS 4.0 score of 6.3 (medium severity) and is fixed in version 4.14.9.
CVE-2026-112336 is a memory leak vulnerability in Wazuh Manager versions 3.0.0 up to but not including 4.14.9. The flaw exists in the generic JSON decoder, where repeated static fields in events can cause memory exhaustion. An attacker can exploit this by enrolling an agent without a password and sending events with duplicate fields such as 'id', leading to an out-of-memory (OOM) kill that disables alerting functionality.
A stack-based buffer overflow vulnerability exists in Wazuh agent versions from 1.0.0 up to but not including 4.14.9 in the logcollector snort-full log reader. The flaw occurs due to miscalculation of remaining buffer space in the read_snortfull() function, allowing crafted multi-line log content to overflow a 65,280-byte stack buffer. This can cause the agent to crash or overwrite the SEH handler on 32-bit Windows agents running as SYSTEM.
Wazuh from 1.0.0 before 4.14.9 contains an out-of-bounds write vulnerability in wazuh-execd that allows privileged manager-configuration attackers to corrupt root process memory via excess ar.conf entries. Attackers controlling ossec.conf active-response blocks can push over 64 commands to agents, overflowing ReadExecConfig() arrays and crashing Active Response fleet-wide.
CVE-2026-62365 is a heap-based buffer overflow vulnerability in the Wazuh security platform affecting versions from 3.9.0 up to but not including 4.14.7. The flaw occurs in the DecodeWinevt function when processing Windows EventChannel Data elements, allowing an enrolled agent to cause a buffer overflow by submitting crafted EventChannel messages. This overflow corrupts heap metadata and leads to a crash of the wazuh-analysisd process, disrupting log ingestion for all agents managed by the affected instance. The issue is fixed in version 4.14.7.
CVE-2026-93347 is a path traversal vulnerability in Wazuh wazuh-manager versions from 4.1.1 up to but not including 4.14.8. It allows malicious cluster workers with the cluster key to read arbitrary files by sending specially crafted DistributedAPI requests with unvalidated filenames. This can expose sensitive files such as client.keys and ossec.conf. The vulnerability is fixed in version 4.14.8.
CVE-2026-93346 is a vulnerability in Wazuh wazuh-manager versions 4.0.0 up to but not including 4.14.8. It involves a race condition in the API login throttling mechanism that allows unauthenticated attackers to bypass the maximum login attempt limits by sending concurrent login requests. This enables attackers to perform unlimited password guessing attacks against the authenticate and run_as endpoints. The issue is fixed in version 4.14.8.
Wazuh Manager versions from 4.0.0 up to but not including 4.14.8 have an information disclosure vulnerability. Low-privileged users with the agent:read permission can access the plaintext enrollment password via an unmasked agent configuration endpoint. This allows attackers with the default readonly role to retrieve the authd.pass secret for a pseudo-agent ID 000 and potentially enroll rogue agents against the manager. The vulnerability is fixed in version 4.14.8.
CVE-2026-74045 is a heap-based buffer overflow vulnerability in Wazuh wazuh-manager versions from 3.12.0 up to but not including 4.14.8. The flaw occurs in the fim_generate_alert() function where a buffer is allocated based on input size but written with a size bounded by OS_MAXSTR, leading to heap corruption. An enrolled agent can exploit this by sending a crafted FIM syscheck event, causing the wazuh-analysisd process to crash and resulting in a fleet-wide detection outage. The vulnerability has a high severity score of 7.1 and was fixed in version 4.14.8.
CVE-2026-74043 is a path traversal vulnerability in Wazuh wazuh-manager versions from 4.1.1 up to but not including 4.14.8. It allows malicious cluster workers who possess the cluster key to write files to arbitrary paths by sending specially crafted DistributedAPI requests with '../' sequences in filenames. This bypasses REST controller validation and enables writing files as the wazuh user. The vulnerability is fixed in version 4.14.8.
CVE-2026-74041 is a high-severity vulnerability in Wazuh wazuh-manager versions 4.14.3 through before 4.14.8 and 4.10.4 through before 4.10.5. It involves a case-sensitivity mismatch between the ossec.conf validator and the wazuh-logcollector component, allowing authenticated users with the manager:update_config privilege to inject an uppercase LOG_FORMAT command. This command is executed by the collector with root privileges upon reload, bypassing remote-command validation.
CVE-2026-74040 is a critical vulnerability in Wazuh wazuh-manager versions 3.9.0 up to but not including 4.14.8. It allows a cluster worker to overwrite protected master files due to missing authorization checks and a basename bypass. This can lead to root remote code execution on the manager and all connected agents. The issue is fixed in version 4.14.8.
Wazuh wazuh-manager versions from 4.0.0 up to but not including 4.14.8 have a vulnerability where issued tokens for run_as users with zero static roles are not properly invalidated. This occurs because the token validation process does not check the blacklist, allowing attackers with revoked administrator privileges to continue authenticating and escalate their privileges permanently. The issue is fixed in version 4.14.8.
Wazuh agent versions from 4.3.0 up to but not including 4.14.8 contain a remote code execution vulnerability due to improper authorization. The vulnerability arises because the SCA policy trust is based on file path rather than the configuration source, allowing an attacker controlling a manager to write unsigned policy files and execute commands as root on agents. This flaw is fixed in version 4.14.8.
Wazuh wazuh-manager versions from 4.6.0 up to but not including 4.14.8 contain an authentication bypass vulnerability. This flaw allows a delegated user administrator to bypass the reserved user guard by sending an empty password to the user update endpoint, enabling takeover of the wazuh superuser account and authentication with empty credentials. The vulnerability is fixed in version 4.14.8.
CVE-2026-74034 is a high-severity vulnerability in Wazuh wazuh-manager versions 4.1.0 up to but not including 4.14.8. It involves a missing origin check in the wm_agent_upgrade functionality, allowing enrolled agents to issue upgrade_custom commands with attacker-controlled file paths. This flaw enables attackers to read arbitrary files as root, including sensitive files like /etc/shadow and client.keys, potentially leading to credential exposure.