Wazuh CVE-2026-54084

Two conditions must be met simultaneously. First, the target Wazuh agent must be in the enrollment phase - this occurs at initial deployment, after a key reset, or following agent restart without a cached key. The enrollment window is time-limited and agent-specific, meaning an attacker must time their response or trigger a re-enrollment. Second, no CA certificate must be configured for manager verification on the affected agent, which allows it to accept enrollment responses from any reachable server without cryptographic validation. If a CA certificate IS configured and enforced, the agent will reject connections from unauthorized managers, blocking the attack entirely. The attacker must also be positioned to deliver the malformed response before the legitimate manager responds (MITM scenario) or must be the server the agent is configured to contact (rogue manager scenario). The impact is strictly denial of service - the agent process terminates; there is no code execution, credential exposure, or lateral movement capability inherent in this flaw.

The CVSS 5.3 (Medium) rating appropriately reflects the constrained attack surface: AV:N establishes a network-reachable entry point, but AC:H captures the prerequisite of either a MITM position during the enrollment handshake or a rogue manager that the agent will connect to without certificate verification. The availability impact is rated High (A:H) because the crash is deterministic - any correctly formed malformed response will reliably terminate the agent - but the scope is unchanged and there is no confidentiality or integrity exposure. No EPSS score was included in the provided intelligence, and the vulnerability is not listed in the CISA KEV catalog, meaning active exploitation in the wild is unconfirmed. However, the crash mechanism is simple enough that the barrier to exploit is effectively the AC:H preconditions rather than any technical sophistication; once an attacker controls the enrollment channel, exploitation is trivial. Organizations that deploy Wazuh agents in environments without strict CA certificate requirements - a common pattern in rapid-deployment or lab contexts - face higher realistic risk than the raw CVSS score suggests, and should prioritize patching to 4.14.7 over relying on CVSS triage alone. The targeted nature of the DoS (individual agent crash, not manager-side) limits blast radius, but silently disabled agents directly undermine the security visibility Wazuh is deployed to provide.

An attacker with a MITM position on the network segment used for agent-manager enrollment (achieved via ARP spoofing, DNS poisoning, or rogue DHCP) intercepts an agent's enrollment request and responds with a truncated key message such as OSSEC K:'1' instead of the expected four-field response. The agent's enrollment parsing routine immediately dereferences a NULL pointer in OS_IsValidName(), crashing the agent process. The agent goes silent, stops forwarding security telemetry to the SIEM, and must be manually re-enrolled - providing a blind spot an attacker could exploit for follow-on activity. No public exploit code has been identified, but the trigger is mechanically straightforward given knowledge of the Wazuh enrollment protocol.