What is the CVSS score of CVE-2026-34150?

CVE-2026-34150 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

Which versions of Wazuh are affected by CVE-2026-34150?

Wazuh analysis engine (wazuh-analysisd) versions 1.0.0 through 4.14.4 face an unauthenticated remote denial-of-service vulnerability that silently halts all SIEM alert processing while the dashboard…

How to fix or mitigate CVE-2026-34150?

Within 24 hours: disable password-less agent enrollment on all Wazuh managers by setting auth_pass_only: true in /var/ossec/etc/ossec.conf, restrict network access to manager ports 1514-1515 to known agent CIDR ranges via firewall rules, and enable verbose rootcheck event logging. Within 7 days: deploy monitoring alerts for wazuh-analysisd process restarts or crashes, enforce certificate or pre-shared key authentication for all agents, and audit enrollment logs for unauthorized agents. Within 30 days: contact Wazuh support to confirm patch timeline and establish an upgrade path for vulnerable versions (or discontinue use if no patch is released on acceptable timeline), implement daily SIEM functionality validation via synthetic test events, and document manual recovery procedures for analysisd failure.

Wazuh CVE-2026-34150

HIGH

Heap-based Buffer Overflow (CWE-122)

2026-07-17 security-advisories@github.com

Buffer Overflow Docker Heap Overflow Wazuh

7.5

CVSS 3.1 · Vendor: github

Severity by source

Vendor (github) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Default-config password-less enrollment enables unauthenticated network exploitation (AV:N/PR:N) at low complexity; impact is a daemon crash, so availability only (A:H, C:N/I:N).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (github).

CVSS VectorVendor: github

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 17, 2026 - 00:29 vuln.today

CVE Published

Jul 17, 2026 - 00:16 cve.org

HIGH 7.5

DescriptionCVE.org

Wazuh is a free and open source platform used for threat prevention, detection, and response. In versions 1.0.0 and above, prior to 4.14.5, a heap buffer overflow in wazuh-analysisd allows an unauthenticated remote attacker to crash the Wazuh manager's analysis engine, causing complete loss of SIEM alert processing. The attack exploits the default configuration shipped in the official wazuh/wazuh-docker deployment with default configuration. An attacker can enroll with authd without a password to obtain a valid agent ID and encryption key, connect to remoted over the Wazuh agent protocol, and inject rootcheck events containing {key: value} patterns longer than 30 bytes that trigger a sprintf overflow of a 30-byte buffer in W_JSON_ParseRootcheck, corrupting the heap and crashing wazuh-analysisd so that all alert processing silently stops while the dashboard and API keep showing stale data.

Articles & Coverage 1

News 4 New Docker Vulnerabilities - 4 High Severity, 1 With POC Jul 17, 2026

AnalysisAI

Denial of service in Wazuh's analysis engine (wazuh-analysisd) lets an unauthenticated remote attacker permanently halt SIEM alert processing on Wazuh manager versions 1.0.0 through 4.14.4. Because the official wazuh/wazuh-docker deployment ships with password-less agent enrollment enabled by default, an attacker can register as an agent and send a crafted rootcheck event that overflows a fixed 30-byte heap buffer, crashing the daemon while the dashboard and API keep showing stale data - silently blinding the SIEM. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.

Technical ContextAI

Wazuh is an open-source security platform (SIEM/XDR) whose manager pipeline ingests agent telemetry through the remoted service and processes it in wazuh-analysisd, the correlation and alerting engine. The flaw (CWE-122, heap-based buffer overflow) resides in W_JSON_ParseRootcheck, which parses rootcheck events formatted as {key: value} pairs. The parser copies parsed content into a statically sized 30-byte buffer using sprintf without bounds checking, so any key/value pattern longer than 30 bytes overruns the heap allocation and corrupts adjacent memory. Per the version data in the advisory, all releases from 1.0.0 up to but not including 4.14.5 are affected in the manager component that handles the Wazuh agent protocol over remoted.

RemediationAI

Vendor-released patch: 4.14.5 - upgrade the Wazuh manager to 4.14.5 or later, which corrects the W_JSON_ParseRootcheck buffer handling; for containerized installs, pull the updated wazuh/wazuh-docker image built on 4.14.5 and redeploy. Where immediate patching is not possible, harden agent enrollment to remove the default password-less path by configuring authd to require a shared enrollment password (use_password) or client-certificate authentication, so attackers cannot self-register and obtain a valid key - the trade-off is added enrollment friction for legitimate agents. Additionally restrict network access to the remoted service (default TCP 1514) and authd (default TCP 1515) to trusted agent subnets via firewall rules, noting this does not stop a malicious host already inside the agent network. See the vendor advisory GHSA-rvr9-89q8-w883 (https://github.com/wazuh/wazuh/security/advisories/GHSA-rvr9-89q8-w883) for authoritative guidance.