Wazuh CVE-2026-33754

The attacker must have Layer-3 network adjacency to the Wazuh cluster communication port, as confirmed by CVSS AV:A - internet-based remote exploitation is not possible unless the cluster port is misconfigured to be externally reachable. No authentication is required (CVSS PR:N) and no user interaction is needed (CVSS UI:N). The vulnerable code path is active only when Wazuh is deployed in multi-node cluster mode and the cluster listener is running; single-node deployments that have not configured clustering may not expose the vulnerable listener at all. Exploitation is limited to denial-of-service against the cluster service; the vulnerability provides no path to code execution, privilege escalation, or data access.

The CVSS 3.1 vector AV:A constrains the attack surface to hosts with Layer-3 adjacency to the Wazuh cluster port - meaning internet-facing exploitation is not possible unless the cluster port is explicitly exposed across network boundaries, which would be a misconfiguration. Within a reachable network segment, exploitation is trivial: AC:L/PR:N/UI:N means no authentication, no complex preconditions, and no victim interaction are required. The impact is purely availability (A:H, C:N, I:N), so there is no risk of data exfiltration or code execution from this vulnerability alone. EPSS data was not provided in the available intelligence, so exploitation probability cannot be quantified. Neither a KEV listing nor a public proof-of-concept is referenced, suggesting no confirmed widespread in-the-wild exploitation at time of analysis. Realistic risk is moderate: organizations that have properly segmented Wazuh cluster ports to trusted manager-to-manager communication paths face limited exposure, while those who have inadvertently exposed the cluster listener to broader network segments face a readily triggerable availability impact on their security monitoring infrastructure.

An attacker with access to the network segment hosting the Wazuh cluster port sends a crafted TCP message whose header encodes an extremely large payload length (e.g., several gigabytes or the maximum integer value). The cluster parser allocates memory equal to the claimed size before performing any authentication check, rapidly consuming available system memory and causing the Wazuh cluster service to crash or become unresponsive. Because the condition is trivially repeatable with no authentication barrier, an attacker can sustain the denial-of-service, silently disabling the target organization's security monitoring and alerting pipeline.