Skip to main content

Wazuh Manager CVE-2026-74046

| EUVDEUVD-2026-61077 MEDIUM
Improper Handling of Highly Compressed Data (Data Amplification) (CWE-409)
2026-08-18 VulnCheck
Denial Of Service Wazuh Wazuh Manager
6.9
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
6.9 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
4.9 MEDIUM

Network delivery to cluster port, low complexity once Fernet key is held (PR:H), no scope change, pure availability impact from memory exhaustion.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
X

Lifecycle Timeline

2
Source Code Evidence Fetched
Aug 18, 2026 - 18:07 vuln.today
Analysis Generated
Aug 18, 2026 - 18:07 vuln.today

DescriptionCVE.org

Wazuh 4.4.0 before 4.14.7 contains a denial of service vulnerability in the fdecompress_files() function within cluster.py that allows authenticated cluster peers to exhaust memory by supplying a malicious synchronization archive without decompressed size limits. Attackers holding a valid cluster Fernet key can upload a small, highly compressed zip bomb archive that forces wazuh-clusterd on the master node to decompress the full payload into memory, causing memory exhaustion and service disruption.

AnalysisAI

Memory exhaustion in Wazuh Manager 4.4.0 through 4.14.6 allows authenticated cluster peers to crash the wazuh-clusterd daemon on the master node by submitting a specially crafted zip bomb archive during cluster synchronization. The fdecompress_files() function in cluster.py invoked zlib.decompress() without any decompressed-size limit, enabling an attacker holding a valid cluster Fernet key to force unbounded memory allocation from a tiny compressed payload. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Recon
Obtain cluster Fernet key
Delivery
Connect to master node TCP cluster port
Exploit
Craft minimal zip bomb archive
Install
Submit archive as synchronization payload
C2
Trigger unbounded zlib.decompress() call
Execute
Exhaust master node memory
Impact
Crash wazuh-clusterd and halt SIEM
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires possession of the Wazuh cluster Fernet key - the shared symmetric key used to authenticate and encrypt all cluster peer communications, stored in /var/ossec/etc/ossec.conf and identical across all nodes. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 score of 6.9 with vector VA:H and PR:H accurately reflects the attack surface: exploitation is bounded by the requirement to control a valid cluster Fernet key, which restricts the realistic threat to compromised peer nodes or insiders with access to cluster configuration. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker who has obtained the Wazuh cluster Fernet key - through credential theft from a worker node configuration file, compromise of a peer node, or insider access - connects to the master node's cluster TCP port and initiates a synchronization exchange. The attacker submits a small, highly compressed zip bomb archive (a few kilobytes compressed that expands to gigabytes) as the synchronization payload, triggering fdecompress_files() to call zlib.decompress() without limits. …
Remediation Upgrade Wazuh Manager to version 4.14.7 or later, which incorporates the fix from GitHub pull request #37119 (https://github.com/wazuh/wazuh/pull/37119); the full vendor security advisory is available at https://github.com/wazuh/wazuh/security/advisories/GHSA-mr7j-w2m4-vw5j. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Wazuh Manager

View all
CVE-2025-15616 HIGH
7.1 Mar 27

Multiple shell injection and untrusted search path vulnerabilities in Wazuh agent and manager (versions 2.1.0 through 4.
CVE-2026-74039 HIGH
7.1 Aug 18

CPU exhaustion in Wazuh Manager 4.0.0-4.14.6 and 5.0.0-beta2 allows authenticated API users with the allow_run_as permis
CVE-2026-74044 HIGH
7.0 Aug 18

Path traversal via unsanitized cluster node names in Wazuh Manager 4.0.0 through 4.14.5 enables authenticated cluster pe
CVE-2026-74038 HIGH
7.0 Aug 18

Path traversal in Wazuh Manager 4.0.0 through 4.14.5 allows unauthenticated remote attackers to destroy the manager's qu
CVE-2025-15615 MEDIUM
6.9 Mar 27

Wazuh Manager authd service through version 4.7.3 fails to properly restrict client-initiated SSL/TLS renegotiation requ

Same weakness CWE-409 – Improper Handling of Highly Compressed Data (Data Amplification)

View all
CVE-2026-59803 HIGH POC
8.7
CVE-2026-49755 HIGH POC
8.2
CVE-2026-48594 HIGH POC
8.2
CVE-2026-59939 HIGH POC
7.5
CVE-2024-7765 HIGH POC
7.5
CVE-2026-22776 HIGH POC
7.5
CVE-2026-22870 HIGH POC
7.5
CVE-2024-3572 HIGH POC
7.5

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Share

CVE-2026-74046 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy