Wazuh has 46 CVEs on record. Disclosure cadence is accelerating: 40 in the last 90 days against 2 in the 90 before. The busiest recent month was August 2026 with 23. The median CVSS is 6.5 (medium), with 7 rated critical. None have a confirmed exploitation report. The dominant weakness classes are CWE-22 (10) and CWE-863 (6). Most affected products: wazuh (31), wazuh-manager (13), wazuh-agent (2).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 6.5
- Publish → KEV
- —
- Last 90 days
- 40 prev 2
Products
- wazuh 31
- wazuh-manager 13
- wazuh-agent 2
Worst active — by depth score
CVE-2026-74041Critical· 9.1Wazuh 4.14.3 before 4.14.8 contains a case-sensitivity mismatch between the ossec.conf validator and wazuh-logcollector that bypasses remote-command validation62CVE-2026-74034High· 7.5Wazuh from 4.1.0 before 4.14.8 contains a missing origin check in wm_agent_upgrade that allows enrolled agents to issue upgrade_custom commands with attacker-controlled file_path53CVE-2026-71540High· 7.5Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads53CVE-2026-74036High· 7.2Wazuh from 4.3.0 before 4.14.8 contains a remote code execution vulnerability where SCA policy trust is determined by file path rather than configuration source52CVE-2026-74045High· 7.1Wazuh from 3.12.0 before 4.14.8 contains a heap buffer overflow in fim_generate_alert() where full_log is sized from input but written bounded by OS_MAXSTR51
Wazuh vulnerabilities
CVEs affecting Wazuh, newest first. Open any entry for full detail, references, and exploit status.
46 CVEsRSS
CVE-2026-93347Medium· 4.9PoCWazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in the get_list_file helper that allows malicious cluster workers to read arbitrary files via unvalidated filename values
Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in the get_list_file helper that allows malicious cluster workers to read arbitrary files via unvalidated filename values. Attackers holding the cluster key can send …
CVE-2026-93346Medium· 5.3Wazuh from 4.0.0 before 4.14.8 contains a race condition in API login throttling that allows unauthenticated attackers to bypass max_login_attempts by sending concurrent requests
Wazuh from 4.0.0 before 4.14.8 contains a race condition in API login throttling that allows unauthenticated attackers to bypass max_login_attempts by sending concurrent requests. Attackers can fire concurrent login bursts to the authent…
CVE-2026-74047Medium· 6.5Wazuh from 4.0.0 before 4.14.8 contains an information disclosure vulnerability that allows low-privileged users with agent:read to retrieve the plaintext authd.pass enrollment password via the unmasked agent configuration endpoint
Wazuh from 4.0.0 before 4.14.8 contains an information disclosure vulnerability that allows low-privileged users with agent:read to retrieve the plaintext authd.pass enrollment password via the unmasked agent configuration endpoint. Atta…
CVE-2026-74045High· 7.1PoCWazuh from 3.12.0 before 4.14.8 contains a heap buffer overflow in fim_generate_alert() where full_log is sized from input but written bounded by OS_MAXSTR
Wazuh from 3.12.0 before 4.14.8 contains a heap buffer overflow in fim_generate_alert() where full_log is sized from input but written bounded by OS_MAXSTR. An enrolled agent can send a crafted FIM syscheck event to corrupt manager heap …
CVE-2026-74043Critical· 9.0Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in upload_list_file, upload_rule_file, and upload_decoder_file that allows malicious cluster workers to write files at arbitrary paths
Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in upload_list_file, upload_rule_file, and upload_decoder_file that allows malicious cluster workers to write files at arbitrary paths. Attackers holding the cluster …
CVE-2026-74041Critical· 9.1PoCWazuh 4.14.3 before 4.14.8 contains a case-sensitivity mismatch between the ossec.conf validator and wazuh-logcollector that bypasses remote-command validation
Wazuh 4.14.3 before 4.14.8 contains a case-sensitivity mismatch between the ossec.conf validator and wazuh-logcollector that bypasses remote-command validation. Authenticated users with manager:update_config can inject an uppercase LOG_F…
CVE-2026-74040Critical· 9.1Wazuh versions from 3.9.0 before 4.14.8 contain an arbitrary file overwrite vulnerability in MasterHandler.process_files_from_worker allowing a cluster worker to overwrite protected master files
Wazuh versions from 3.9.0 before 4.14.8 contain an arbitrary file overwrite vulnerability in MasterHandler.process_files_from_worker allowing a cluster worker to overwrite protected master files. Attackers controlling a worker can use a …
CVE-2026-74037High· 7.2Wazuh 4.0.0 before 4.14.8 fails to invalidate issued tokens for run_as users with zero static roles, because check_token never consults the blacklist
Wazuh 4.0.0 before 4.14.8 fails to invalidate issued tokens for run_as users with zero static roles, because check_token never consults the blacklist. Attackers with revoked administrator grants can continue authenticating and self-link …
CVE-2026-74036High· 7.2PoCWazuh from 4.3.0 before 4.14.8 contains a remote code execution vulnerability where SCA policy trust is determined by file path rather than configuration source
Wazuh from 4.3.0 before 4.14.8 contains a remote code execution vulnerability where SCA policy trust is determined by file path rather than configuration source. Attackers controlling a manager can write unsigned policy files to var/inco…
CVE-2026-74035High· 7.2Wazuh versions from 4.6.0 before 4.14.8 contain an authentication bypass vulnerability where security.update_user places the reserved user guard and password policy inside a falsy truthiness check
Wazuh versions from 4.6.0 before 4.14.8 contain an authentication bypass vulnerability where security.update_user places the reserved user guard and password policy inside a falsy truthiness check. A delegated user administrator can send…
CVE-2026-74034High· 7.5PoCWazuh from 4.1.0 before 4.14.8 contains a missing origin check in wm_agent_upgrade that allows enrolled agents to issue upgrade_custom commands with attacker-controlled file_path
Wazuh from 4.1.0 before 4.14.8 contains a missing origin check in wm_agent_upgrade that allows enrolled agents to issue upgrade_custom commands with attacker-controlled file_path. Attackers can inject an upgrade_custom message over the a…
CVE-2026-74033Medium· 6.1Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in the get_lists() and delete_list_file() CDB list handlers that allows compromised cluster workers to read or delete master files
Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in the get_lists() and delete_list_file() CDB list handlers that allows compromised cluster workers to read or delete master files. Attackers can send traversal or ab…
CVE-2026-74032Medium· 4.3Wazuh from 4.0.0 before 4.14.8 contains an authorization bypass vulnerability that allows low-privileged authenticated users to read the RBAC catalog by querying unprotected security endpoints
Wazuh from 4.0.0 before 4.14.8 contains an authorization bypass vulnerability that allows low-privileged authenticated users to read the RBAC catalog by querying unprotected security endpoints. Attackers can request GET /security/actions…
CVE-2026-74031Medium· 6.5PoCWazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in the delete_rule_file and delete_decoder_file helpers that allows malicious cluster workers to delete arbitrary files via an unvalidated filename parameter
Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in the delete_rule_file and delete_decoder_file helpers that allows malicious cluster workers to delete arbitrary files via an unvalidated filename parameter. Attacke…
CVE-2026-74030Medium· 4.9Wazuh from 3.9.0 before 4.14.8 contains an uncontrolled YAML alias expansion vulnerability in yaml2json_node that allows a manager-controlled policy to exhaust agent memory
Wazuh from 3.9.0 before 4.14.8 contains an uncontrolled YAML alias expansion vulnerability in yaml2json_node that allows a manager-controlled policy to exhaust agent memory. Attackers controlling the manager can push a small SCA policy w…
CVE-2026-71540High· 7.5PoCWazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads
Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. From 3.9.0 until 4.14.7, wazuh-clusterd in framework/wazuh/core/cluster/common.py allocates a payload buffer using the…
CVE-2026-61811Medium· 6.5PoCWazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads
Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. From 3.8.0 until 4.14.7, the _getattributes() function in src/os_xml/os_xml.c recursively processes every XML attribut…
CVE-2026-61802Medium· 6.5Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads
Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. In versions 4.14.0 through 4.14.6, a low-privilege API user can read the cleartext cluster key from a configuration en…
CVE-2026-61800Critical· 9.1Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads
Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. In versions 4.4.0 through 4.14.6, a party holding the cluster key can write, overwrite, or delete arbitrary files unde…
CVE-2026-61783Medium· 6.5Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads
Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. In versions 4.14.0 through 4.14.6, an authenticated low-privilege user can read the cluster secret from the manager co…
CVE-2026-54085High· 7.1Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads
Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. In versions 4.2.0 through 4.14.6, multiple active response scripts pass attacker-influenced alert fields to privileged…
CVE-2026-54084Medium· 5.3Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads
Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. In versions 4.0.0 through 4.14.6, a malicious or man-in-the-middle enrollment manager can crash a Wazuh agent during e…
CVE-2026-54083High· 8.1Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads
Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. The ip-customblock active response script contains a path traversal vulnerability that lets an attacker create or de…
CVE-2026-44256Medium· 5.3Wazuh is a free and open source platform used for threat prevention, detection, and response
Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.4.0 until 4.14.6 and 5.0.0-beta2, api/api/middlewares.py decodes the Basic authentication username before credential validation and pass…
CVE-2026-44253Medium· 4.9PoCWazuh is a free and open source platform used for threat prevention, detection, and response
Wazuh is a free and open source platform used for threat prevention, detection, and response. From 3.9.0 until 4.14.5 and 5.0.0-beta2, the Wazuh cluster protocol in framework/wazuh/core/cluster/common.py allows an authenticated cluster n…
CVE-2026-49441Critical· 9.1Wazuh is a free and open source platform used for threat prevention, detection, and response
Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.3.0 until 4.14.6 and 5.0.0-beta3, the non-merged branch of process_files_from_worker() in framework/wazuh/core/cluster/master.py trusts …
CVE-2026-49392Medium· 5.3Wazuh is a free and open source platform used for threat prevention, detection, and response
Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.6.0 until 4.14.6 and 5.0.0-beta3, DB::getFile() and DB::searchFile() in src/syscheckd/src/db/src/file.cpp concatenate a monitored file p…
CVE-2026-48162Critical· 9.1Wazuh is a free and open source platform used for threat prevention, detection, and response
Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.0.0 until 4.14.6 and 5.0.0-beta3, DistributedAPI.send_tmp_file() in framework/wazuh/core/cluster/dapi/dapi.py joins an attacker-controll…
CVE-2026-48024Critical· 9.1Wazuh is a free and open source platform used for threat prevention, detection, and response
Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.0.0 until 4.14.6 and 5.0.0-beta3, cluster.unmerge_info() in framework/wazuh/core/cluster/cluster.py constructs paths from peer-controlle…
CVE-2026-45798High· 7.5Wazuh is a free and open source platform used for threat prevention, detection, and response
Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.5.0 until 4.14.6 and 5.0.0-beta2, compare_wazuh_versions() in src/shared/version_op.c copies the attacker-controlled enrollment V: field…