Wazuh Manager EUVD-2026-98673

Exploitation requires an authenticated account holding delegated user-administration rights (the ability to call the security.update_user RBAC endpoint) on Wazuh Manager 4.6.0 through 4.14.7. The specific trigger is sending an empty password value in a user-update request for the reserved wazuh superuser; the empty string evaluates as falsy and skips both the reserved-user guard and password-policy enforcement. Limiting factors: the attacker must already possess privileged (PR:H) user-management access - there is no unauthenticated or low-privilege path - so realistic risk is concentrated in deployments that delegate user administration to less-trusted operators or in post-compromise escalation; no user interaction or non-default configuration beyond having a delegated admin role is required.

This is a genuine high-priority issue for any multi-tenant or role-delegated Wazuh deployment, though not a drive-by threat. The vendor's CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N, score 8.6) describes network-reachable, low-complexity exploitation with no user interaction but requiring HIGH privileges (PR:H) - consistent with the description's requirement for an authenticated 'delegated user administrator'. Impact is full triad compromise (VC:H/VI:H/VA:H) because the flaw yields takeover of the wazuh superuser account, i.e. complete control of the security monitoring platform. No EPSS score, SSVC decision, KEV listing, or POC was provided, so exploitation-probability signals are absent rather than conflicting; per input data this is 'no public exploit identified at time of analysis'. The key tension: raw CVSS is 8.6 (High) and the bug is trivially reliable once prerequisites are met, but the PR:H gate means the attacker must already be a privileged (delegated) administrator - this is primarily a privilege-escalation / insider or post-compromise lateral-movement path rather than an unauthenticated external breach. Prioritize patching where user-administration is delegated to less-trusted operators.

An organization delegates day-to-day Wazuh user management to a junior operator with a limited 'user administrator' role. That operator calls the security.update_user API endpoint targeting the reserved wazuh superuser and submits an empty password; because the reserved-user guard and password policy sit behind a falsy truthiness check, the empty value bypasses both, and the operator then authenticates as the all-powerful wazuh superuser. No public exploit code was identified in the provided data.