Wazuh Manager EUVD-2026-98681

Exploitation requires network reachability to the Wazuh Manager REST API, specifically the 'authenticate' and 'run_as' login endpoints, and the ability to send multiple concurrent (parallel) requests so they each pass the throttling block check before failure counters increment - a sequential attacker is still rate-limited, so concurrency is the essential trigger. It affects default configurations of Wazuh Manager 4.0.0 through 4.14.7 (the brute-force protection is on by default), so no non-default feature flag is needed. Limiting factors: the flaw only removes the login-attempt ceiling, so the attacker still needs to actually guess a valid credential - strong/unique API passwords, network segmentation or IP allow-listing of the API, and upgrading to 4.14.8 all neutralize practical impact.

This is a genuine but moderate-priority issue, not a top-tier emergency. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a remotely reachable, low-complexity, unauthenticated flaw, but the technical impact is deliberately scoped to VC:L / VI:N / VA:N - the race condition itself only weakens brute-force protection (CWE-307), it does not directly grant access or expose data. No EPSS score was provided, the CVE is NOT in CISA KEV, and no public exploit was supplied in the intelligence, so there is no public exploit identified at time of analysis; this argues against treating it as actively exploited. The real risk is conditional: it becomes serious only when combined with weak, reused, or default Wazuh API credentials, since removing the max_login_attempts ceiling turns online password guessing from rate-limited into effectively unlimited. In short, moderate standalone severity (6.9) that escalates sharply in environments with poor credential hygiene; prioritize patching on internet-exposed managers but it is not a drop-everything critical. Note one consistency caveat: the input supplies only a CVSS 4.0 vector and no 3.1 vector or EPSS value, so probability-of-exploitation signals are inferred rather than measured.

An attacker who can reach a Wazuh Manager API (authenticate/run_as endpoints) over the network scripts many simultaneous login attempts against a targeted account instead of sending them sequentially. Because each concurrent request passes the block check before any failure is counted, the max_login_attempts lockout never triggers, allowing unlimited password guessing to recover valid API credentials. No public exploit was identified at time of analysis, and the low attack complexity means a simple threaded/async HTTP script suffices.