Wazuh vulnerabilities
97 CVEs and advisories name Wazuh as an affected vendor, 1 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-28221Wazuh: Pre-auth stack-based buffer overflow in wazuh-remoted print_hex_string() due to signed char promotion on x86_64
- CVE-2026-26206Wazuh: API brute-force protection bypass via race condition in login attempt tracking
- CVE-2026-26204Wazuh: Heap-based NULL WRITE Buffer Underflow in GetAlertData
- CVE-2025-15612Wazuh Provisioning Scripts / Build Infrastructure Improper Certificate Validation leading to MITM and RCE
- CVE-2025-15617Wazuh GitHub Actions Workflow Exposure of Sensitive Credentials
- CVE-2025-15616Wazuh Agent and Manager OS Command Injection and Untrusted Search Path
- CVE-2025-15615Wazuh Manager authd service Improper SSL/TLS Renegotiation Handling leading to Denial of Service
- CVE-2023-7340Wazuh authd service (os_auth) Heap-based Buffer Overflow
- CVE-2026-32983SSL/TLS Renegotiation DoS in Wazuh Manager authd service
- CVE-2026-32984Heap buffer overflow in wazuh-authd
- CVE-2026-25790Wazuh has Stack-Based Buffer Overflow in Security Configuration Assessment JSON Parser
- CVE-2026-25772Wazuh Database Synchronization Vulnerable to Stack-based Buffer Overflow via snprintf Integer Underflow
- CVE-2026-25771Wazuh Vulnerable to Denial of Service via Synchronous I/O Blocking in Asynchronous Authentication Middleware
- CVE-2026-25770Wazuh has Privilege Escalation to Root via Cluster Protocol File Write
- CVE-2026-25769Wazuh Cluster vulnerable to Remote Code Execution via Insecure Deserialization
- CVE-2025-64169Wazuh NULL pointer dereference in fim_alert line 666
- CVE-2025-54866Wazuh installation fails to protected authd.pass on Windows
- CVE-2025-30201Wazuh NetNTLMv2 Hash Theft In Multiple Centralized Configuration Capabilities
- CVE-2025-64483Wazuh API – Agent Configuration Has Improper Access Control in Agent Enrollment Endpoint
- CVE-2025-62792Wazuh vulnerable to Heap-based Buffer Over-read in w_expression_match
- CVE-2025-62791Wazuh vulnerable to NULL pointer dereference in DecodeCiscat
- CVE-2025-62790Wazuh vulnerable to NULL pointer dereference in fim_fetch_attributes_state
- CVE-2025-62789Wazuh vulnerable to NULL pointer dereference in fim_alert line 712
- CVE-2025-62788Wazuh Vulnerable to Heap Use After Free in w_copy_event_for_log
- CVE-2025-62787Wazuh Vulnerable to Heap-based Buffer Over-read in DecodeWinevt
- CVE-2025-62786Wazuh Vulnerable to Heap-based Buffer Out-Of-Bounds WRITE in decode_win_permissions
- CVE-2025-62785Wazuh fillData NULL pointer dereference causes analysisd crash
- CVE-2025-59938Heap buffer overflow in wazuh-analysisd
- CVE-2024-1243Remote code execution and local privilege escalation in Wazuh Windows agent via NetNTLMv2 hash theft
- CVE-2025-24016Remote code execution in Wazuh server