Wazuh Manager CVE-2026-74045

Requires a valid enrolled Wazuh agent (PR:L) that can send FIM/syscheck events to wazuh-analysisd on the manager; File Integrity Monitoring is enabled by default in Wazuh agents, so no special manager configuration is needed. The attacker must possess or compromise an agent's enrollment key/registration to inject the crafted oversized full_log event - this agent-trust prerequisite is the primary limiting factor and means fully external unauthenticated parties cannot trigger it. Affected versions are Wazuh 3.12.0 through 4.14.7 (fixed in 4.14.8); no user interaction is required and the crash is deterministic once the event is accepted.

The vendor CVSS 4.0 score of 7.1 (HIGH) is driven almost entirely by availability (VA:H) - this is fundamentally a denial-of-service/detection-outage bug, not a code-execution or data-disclosure flaw (VC:N, VI:L for heap corruption only). The vector AV:N/AC:L/AT:N/PR:L/UI:N shows a network-reachable, low-complexity attack with no user interaction, but PR:L is the critical mitigating signal: exploitation requires a VALID ENROLLED AGENT already trusted by the manager, so this is not a fully unauthenticated external attack. No EPSS probability was provided in the input, so widespread-exploitation likelihood cannot be quantified. There is no CISA KEV listing and no public exploit code identified, so this is not confirmed active exploitation. The realistic threat model is an insider or an attacker who has already compromised/registered one agent using that foothold to blind the entire fleet's detection pipeline (a force-multiplier that could mask other intrusions) - a meaningful but targeted risk rather than a mass-exploitation emergency. The finding originates from VulnCheck, a credible research source, which raises confidence in the technical details. Net: a genuine priority for Wazuh operators to patch, but its real-world severity is bounded by the agent-enrollment prerequisite and its DoS-only (not RCE) impact.

An attacker who controls an enrolled Wazuh agent (e.g., a compromised monitored host or a malicious insider) crafts a FIM syscheck event with a full_log field larger than OS_MAXSTR and sends it to the manager. When wazuh-analysisd processes it in fim_generate_alert(), the undersized bounded write corrupts heap memory and deterministically crashes the analysis daemon, halting alert generation for every agent in the deployment. No public exploit code has been identified at time of analysis.