CVE-2026-93346: Wazuh Wazuh-Manager

Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days.

Wazuh from 4.0.0 before 4.14.8 contains a race condition in API login throttling that allows unauthenticated attackers to bypass max_login_attempts by sending concurrent requests. Attackers can fire concurrent login bursts to the authenticate and run_as endpoints, each passing the block check before failures are counted, enabling unlimited password guessing.

Affected products

• Wazuh Wazuh-Manager: from 4.0.0, before 4.14.8 (fixed in 4.14.8)

Published 2026-10-13. Last modified 2026-10-16.