Wazuh Wazuh-Manager vulnerabilities

14 CVEs affecting Wazuh Wazuh-Manager, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-93347, published 2026-10-13.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-74040, published 2026-10-13. Critical severity, CVSS 9.1. EPSS: 0.6% chance of exploitation in the next 30 days. Wazuh versions from 3.9.0 before 4.14.8 contain an arbitrary file overwrite vulnerability in MasterHandler.process_files_from_worker allowing a cluster worker to overwrite protected master files.…
CVE-2026-74031, published 2026-10-13. Medium severity, CVSS 6.5. EPSS: 0.5% chance of exploitation in the next 30 days. Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in the delete_rule_file and delete_decoder_file helpers that allows malicious cluster workers to delete arbitrary files via an…
CVE-2026-74035, published 2026-10-13. High severity, CVSS 7.2. EPSS: 0.5% chance of exploitation in the next 30 days. Wazuh versions from 4.6.0 before 4.14.8 contain an authentication bypass vulnerability where security.update_user places the reserved user guard and password policy inside a falsy truthiness check. A…
CVE-2026-74030, published 2026-10-13. Medium severity, CVSS 4.9. EPSS: 0.4% chance of exploitation in the next 30 days. Wazuh from 3.9.0 before 4.14.8 contains an uncontrolled YAML alias expansion vulnerability in yaml2json_node that allows a manager-controlled policy to exhaust agent memory. Attackers controlling the…
CVE-2026-74037, published 2026-10-13. High severity, CVSS 7.2. EPSS: 0.4% chance of exploitation in the next 30 days. Wazuh 4.0.0 before 4.14.8 fails to invalidate issued tokens for run_as users with zero static roles, because check_token never consults the blacklist. Attackers with revoked administrator grants can…
CVE-2026-74041, published 2026-10-13. Critical severity, CVSS 9.1. EPSS: 0.4% chance of exploitation in the next 30 days. Wazuh 4.14.3 before 4.14.8 contains a case-sensitivity mismatch between the ossec.conf validator and wazuh-logcollector that bypasses remote-command validation. Authenticated users with…
CVE-2026-74043, published 2026-10-13. Critical severity, CVSS 9.0. EPSS: 0.4% chance of exploitation in the next 30 days. Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in upload_list_file, upload_rule_file, and upload_decoder_file that allows malicious cluster workers to write files at arbitrary…
CVE-2026-74034, published 2026-10-13. High severity, CVSS 7.5. EPSS: 0.3% chance of exploitation in the next 30 days. Wazuh from 4.1.0 before 4.14.8 contains a missing origin check in wm_agent_upgrade that allows enrolled agents to issue upgrade_custom commands with attacker-controlled file_path. Attackers can…
CVE-2026-74045, published 2026-10-13. High severity, CVSS 7.1. EPSS: 0.3% chance of exploitation in the next 30 days. Wazuh from 3.12.0 before 4.14.8 contains a heap buffer overflow in fim_generate_alert() where full_log is sized from input but written bounded by OS_MAXSTR. An enrolled agent can send a crafted FIM…
CVE-2026-93347, published 2026-10-13. Medium severity, CVSS 4.9. EPSS: 0.3% chance of exploitation in the next 30 days. Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in the get_list_file helper that allows malicious cluster workers to read arbitrary files via unvalidated filename values.…

Latest

CVE-2026-93346, published 2026-10-13. Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days. Wazuh from 4.0.0 before 4.14.8 contains a race condition in API login throttling that allows unauthenticated attackers to bypass max_login_attempts by sending concurrent requests. Attackers can fire…
CVE-2026-74047, published 2026-10-13. Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days. Wazuh from 4.0.0 before 4.14.8 contains an information disclosure vulnerability that allows low-privileged users with agent:read to retrieve the plaintext authd.pass enrollment password via the…