Wazuh CVE-2026-26206

Exploitation requires network-level access to the Wazuh server API endpoint (POST /security/user/authenticate, default TCP port 55000) and the ability to issue concurrent HTTP requests - achievable with any standard multi-threaded or async HTTP client library. No authentication, no special configuration, and no specific platform version beyond Wazuh 4.0.0-4.14.3 is required. The attack is effective against default Wazuh installations with the API accessible over the network. Limiting factors: the attacker must still correctly guess valid credentials after bypassing the rate limit, meaning weak or default passwords are a necessary precondition for actual account compromise; no direct code execution or data access occurs from the bypass alone. If the Wazuh API is firewall-restricted to management-only networks (a recommended hardening practice), the attack surface is substantially reduced. The CVSS PR:N confirms the endpoint is reachable without prior authentication.

The CVSS 6.5 score with vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N reflects a network-accessible unauthenticated attack with no complexity barriers, which accurately captures the ease of triggering the bypass. However, CVSS does not capture the bounded impact: the vulnerability amplifies guessing capacity but does not directly compromise credentials - attackers still need to successfully guess a valid password, making actual exploitation dependent on weak credential hygiene. SSVC rates this as automatable with partial technical impact, consistent with scripted parallel HTTP burst tooling being trivially constructible. EPSS at 0.05% (14th percentile) sharply contrasts with the SSVC automatable classification, suggesting that despite the ease of exploitation, real-world threat actors have not broadly operationalized this vector at time of analysis - no CISA KEV listing corroborates active exploitation. The realistic priority is medium: environments with Wazuh APIs exposed to untrusted networks and weak passwords face genuine credential brute-force risk; environments with API access restricted to management networks have substantially reduced exposure.

An unauthenticated attacker with network access to the Wazuh API endpoint uses a scripted HTTP client to dispatch dozens of concurrent POST /security/user/authenticate requests in a single burst, each attempting a different password for a known or enumerated username. Because the IP block is not atomically enforced, all parallel requests are processed before the counter trips, doubling or more the effective guessing rate beyond the configured policy. The attack is repeatable and automatable with standard concurrency libraries, with no specialized tooling required beyond a multi-threaded HTTP client.