Product by Wazuh

    Wazuh-manager

    21 known vulnerabilities in Wazuh-manager (Wazuh), 0 of them actively exploited (CISA KEV).

    Key figures

    21

    Vulnerabilities

    0

    Actively exploited (KEV)

    0

    Used by ransomware

    2

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.

    Vulnerabilities in Wazuh-manager (Wazuh)
    CriticalCVE-2026-74040

    Wazuh 3.9.0 before 4.14.8 Arbitrary File Overwrite RCE via process_files_from_worker

    also in 1 other product

    		9.1
    HighCVE-2025-15616

    Wazuh Agent and Manager OS Command Injection and Untrusted Search Path

    also in 2 other products

    		6.7
    HighCVE-2026-74035

    Wazuh 4.6.0 before 4.14.8 Authentication Bypass via Empty Password in update_user

    also in 1 other product

    		7.2
    HighCVE-2026-74037

    Wazuh 4.0.0 before 4.14.8 Session Invalidation Bypass in check_token

    also in 1 other product

    		7.2
    HighCVE-2026-74041

    Wazuh 4.14.3 < 4.14.8 / 4.10.4 Remote Command Validation Bypass via Case Mismatch

    also in 1 other product

    		7.2
    HighCVE-2026-74034

    Wazuh 4.1.0 before 4.14.8 Arbitrary File Read via upgrade_custom Command

    also in 1 other product

    		7.5
    CriticalCVE-2026-74043

    Wazuh 4.1.1 before 4.14.8 Path Traversal via Cluster Upload Functions

    also in 1 other product

    		9.0
    HighCVE-2026-74031

    Wazuh 4.1.1 before 4.14.8 Path Traversal File Deletion via Rule/Decoder Delete Helpers

    also in 1 other product

    		6.5
    HighCVE-2026-74033

    Wazuh from 4.1.1 before 4.14.8 Path Traversal in CDB List Cluster Handlers

    also in 1 other product

    		6.1
    HighCVE-2026-74044

    Wazuh 4.0.0 < 4.14.6 Path Traversal Arbitrary Directory Deletion via Cluster Hello

    also in 2 other products

    		6.5
    MediumCVE-2026-74046

    Wazuh 4.4.0 < 4.14.7 DoS via fdecompress_files() Zip Bomb

    also in 2 other products

    		4.9
    HighCVE-2026-74039

    Wazuh 4.0.0 < 4.14.7 API DoS via Deeply Nested JSON auth_context

    also in 2 other products

    		6.5
    HighCVE-2026-74038

    Wazuh 4.0.0 < 4.14.6 Path Traversal DoS via Agent Enrollment

    also in 2 other products

    		7.1
    MediumCVE-2026-93347

    Wazuh 4.1.1 before 4.14.8 Path Traversal via Cluster get_list_file

    also in 1 other product

    		4.9
    MediumCVE-2026-74030

    Wazuh 3.9.0 before 4.14.8 Memory Exhaustion via SCA YAML Alias Expansion

    also in 2 other products

    		4.9
    HighCVE-2026-74045

    Wazuh 3.12.0 before 4.14.8 Heap Buffer Overflow in wazuh-analysisd FIM Decoder

    also in 1 other product

    		7.1
    HighCVE-2026-74047

    Wazuh 4.0.0 before 4.14.8 authd.pass Disclosure via Agent 000 Config Endpoint

    also in 1 other product

    		6.5
    MediumCVE-2026-93346

    Wazuh 4.0.0 before 4.14.8 API Brute-Force Protection Bypass via Race Condition

    also in 1 other product

    		5.3
    HighCVE-2025-15615

    Wazuh Manager authd service Improper SSL/TLS Renegotiation Handling leading to Denial of Service

    also in 1 other product

    		5.8
    HighCVE-2026-32983

    SSL/TLS Renegotiation DoS in Wazuh Manager authd service

    also in 1 other product

    		7.5
    MediumCVE-2026-74032

    Wazuh 4.0.0 before 4.14.8 RBAC Authorization Bypass via /security/actions

    also in 1 other product

    		4.3

    All products by Wazuh