Which versions of Wazuh are affected by CVE-2026-32984?

Organizations using Wazuh authd should be aware of moderate risk from CVE-2026-32984, a out-of-bounds read vulnerability rated CVSS 5.3.

How to fix or mitigate CVE-2026-32984?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Wazuh CVE-2026-32984

Q: What is the CVSS score of CVE-2026-32984?

CVE-2026-32984 has a CVSS 4.0 base score of 5.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-16688 MEDIUM

Out-of-bounds Read (CWE-125)

2026-03-27 VulnCheck

GHSA-prvg-j23h-9v2j

Buffer Overflow Denial Of Service Information Disclosure Wazuh

5.3

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

EUVD ID Assigned

Mar 27, 2026 - 15:30 euvd

EUVD-2026-16688

Analysis Generated

Mar 27, 2026 - 15:30 vuln.today

CVE Published

Mar 27, 2026 - 15:02 nvd

MEDIUM 5.3

DescriptionCVE.org

Wazuh authd contains a heap-buffer overflow vulnerability that allows attackers to cause memory corruption and malformed heap data by sending specially crafted input. Attackers can exploit this vulnerability to trigger a denial of service condition, resulting in low availability impact to the authentication daemon.

AnalysisAI

Wazuh authd daemon contains a heap-buffer overflow vulnerability (CWE-125) triggered by specially crafted input from authenticated remote users, causing memory corruption and denial of service to the authentication daemon. The vulnerability affects all versions of Wazuh (CPE: cpe:2.3:a:wazuh:wazuh:*:*:*:*:*:*:*:*) and requires authenticated network access to exploit; no public exploit code or active exploitation has been confirmed at this time.

Technical ContextAI

The vulnerability resides in Wazuh's authd (authentication daemon), a critical component responsible for agent authentication and enrollment in the Wazuh security monitoring platform. The root cause is classified under CWE-125 (Out-of-bounds Read), which typically indicates improper bounds checking in heap memory operations. When authd processes specially crafted authentication requests from authenticated users, a heap-buffer overflow condition is triggered, leading to memory corruption. The vulnerability is network-accessible (CVSS AV:N) but requires prior authentication (PR:L), meaning an attacker must possess valid Wazuh credentials to trigger the flaw.

RemediationAI

Consult the Wazuh vendor security advisory (https://github.com/advisories/GHSA-grjq-p5fg-m24r) for the specific patched version and upgrade authd to the recommended release. As an interim mitigation, restrict network access to the authd service to trusted administrative hosts and networks, enforce strong authentication mechanisms (multi-factor authentication where supported), and monitor authd process logs for abnormal memory errors or crashes. Consider deploying Wazuh in a network segmentation strategy to limit the propagation of a potential denial of service condition to other infrastructure components.