CVE-2025-15615: Wazuh

High severity, CVSS 7.5. EPSS: 0.5% chance of exploitation in the next 30 days.

Wazuh Manager authd service in wazuh-manager packages through version 4.7.3 contains an improper restriction of client-initiated SSL/TLS renegotiation vulnerability that allows remote attackers to cause a denial of service by sending excessive renegotiation requests. Attackers can exploit the lack of renegotiation limits to consume CPU resources and render the authd service unavailable.

Affected products

• Wazuh Wazuh: before 4.8.0 (fixed in 4.8.0)

Published 2026-03-27. Last modified 2026-10-07.