Wazuh vulnerabilities and fixes

CVEs that mention Wazuh, ranked by priority. 4 tracked.

Wazuh has 4 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 4. Most recent: 2026-08-18. Highest priority: CVE-2026-74038 (score 41/100).

• CVE-2026-74038 HIGH 7.1 UPGRADE Wazuh 4.0.0 before 4.14.6 contains a path traversal vulnerability that allows unauthenticated remote attackers
• CVE-2026-74044 MEDIUM 6.5 UPGRADE Wazuh 4.0.0 before 4.14.6 contains a path traversal vulnerability that allows authenticated cluster peers to d
• CVE-2026-74039 MEDIUM 6.5 UPGRADE Wazuh 4.0.0 before 4.14.7 and 5.0.0-beta2 contain a denial of service vulnerability that allows authenticated
• CVE-2026-74046 MEDIUM 4.9 UPGRADE Wazuh 4.4.0 before 4.14.7 contains a denial of service vulnerability in the fdecompress_files() function withi

FAQ

How do I fix Wazuh vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is Wazuh being exploited right now?

None of the tracked Wazuh CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which Wazuh CVE should I patch first?

CVE-2026-74038 currently ranks highest (41/100): Wazuh 4.0.0 before 4.14.6 contains a path traversal vulnerability that allows unauthenticated remote attackers.

← Back to latest CVEs