EUVD-2026-16686Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
Wazuh Manager authd service in wazuh-manager packages through version 4.7.3 contains an improper restriction of client-initiated SSL/TLS renegotiation vulnerability that allows remote attackers to cause a denial of service by sending excessive renegotiation requests. Attackers can exploit the lack of renegotiation limits to consume CPU resources and render the authd service unavailable.
AnalysisAI
Wazuh Manager authd service through version 4.7.3 fails to properly restrict client-initiated SSL/TLS renegotiation, enabling remote attackers to trigger denial of service by flooding the service with excessive renegotiation requests that exhaust CPU resources and render the authentication daemon unavailable. The vulnerability affects all Wazuh Manager installations up to and including version 4.7.3, requires no authentication or user interaction, and can be exploited over the network by any remote actor. No public exploit code or active exploitation has been confirmed at this time, though the straightforward nature of renegotiation-based DoS attacks and moderate CVSS score of 6.9 indicate practical exploitability.
Technical ContextAI
The vulnerability resides in Wazuh Manager's authd (authentication daemon) service, which handles client authentication via SSL/TLS protocol. The root cause is classified under CWE-276 (Incorrect Default Permission), though the attack vector involves improper restriction of client-initiated TLS renegotiation handshakes. TLS renegotiation is a legitimate protocol feature allowing clients to request new handshakes mid-session to refresh cryptographic material; however, without rate limiting or reasonable bounds on renegotiation frequency, an attacker can exploit this feature as a resource exhaustion vector. The authd service, which is integral to Wazuh Manager's role-based access control and agent enrollment (CPE: cpe:2.3:a:wazuh:wazuh-manager), becomes unavailable when CPU is consumed by processing an unbounded stream of renegotiation requests, effectively denying legitimate agents and administrators access to authentication services.
RemediationAI
Upgrade Wazuh Manager to a patched version released after 4.7.3; consult the official Wazuh security advisory at https://github.com/advisories/GHSA-rr83-v9v7-jjhp for the specific fixed version number and download instructions. Pending upgrade, apply network-level mitigations by restricting SSL/TLS renegotiation at the firewall or reverse proxy (disable client-initiated renegotiation using TLS_NO_RENEGOTIATION or equivalent settings in your TLS terminator), implement rate limiting on renegotiation requests if your load balancer supports per-connection TLS controls, and monitor authd process CPU usage for sudden spikes that may indicate active exploitation. Consider temporarily restricting network access to the authd service (port 1515 by default) to trusted agent subnets only, and ensure redundant authd instances are deployed to mitigate single-point-of-failure impact.
Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t
In the wazuh-slack active response script in Wazuh 4.2.x before 4.2.5, untrusted user agents are passed to a curl comman
A critical deserialization vulnerability in Wazuh's cluster mode allows attackers with access to any worker node to achi
The agent in OSSEC through 3.1.0 on Windows allows local users to gain NT AUTHORITY\SYSTEM access via Directory Traversa
CVE-2024-1243 is an improper input validation vulnerability in Wazuh agent for Windows (versions prior to 4.8.0) that al
Wazuh Manager in Wazuh through 4.1.5 is affected by a remote Integer Underflow vulnerability that might lead to denial o
NDJSON injection in Wazuh Manager before 5.0.0-beta3 lets any enrolled agent smuggle arbitrary OpenSearch bulk operation
Wazuh is a free and open source platform used for threat prevention, detection, and response. Rated critical severity (C
Privilege escalation in Wazuh Manager versions 3.9.0 through 4.14.2 allows authenticated cluster nodes to achieve unauth
Wazuh Manager (4.4.0 through 4.14.3) contains a path traversal vulnerability in the cluster synchronization routine that
Wazuh is a security detection, visibility, and compliance open source project. Rated high severity (CVSS 8.8), this vuln
Wazuh v3.6.1 - v3.13.5, v4.0.0 - v4.2.7, and v4.3.0 - v4.3.7 were discovered to contain an authenticated remote code exe
Same weakness CWE-276 – Incorrect Default Permissions
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today