CVE-2025-15615 Wazuh CVE debrief

Who should care

Wazuh Manager administrators and security teams should assess exposure and prioritize remediation to prevent disruption of authentication services. They should review and update Wazuh Manager to version 4.8.0 or later, implement rate limiting on SSL/TLS renegotiation requests, and monitor authd service for unusual activity and excessive CPU usage. Additionally, they should verify Wazuh Manager version and configuration, and check relevant monitoring, and

Why it matters

CVE-2025-15615 is a medium-severity vulnerability in Wazuh Manager authd service that allows remote attackers to cause a denial of service. Wazuh Manager administrators and security teams should assess exposure, prioritize remediation, and implement compensating controls to prevent disruption of authentication services.

• Denial of service through excessive CPU usage
• Potential disruption of authentication services
• Need for rate limiting on SSL/TLS renegotiation requests
• Verification of Wazuh Manager version and configuration

Technical summary

The Wazuh Manager authd service in wazuh-manager packages through version 4.7.3 contains an improper restriction of client-initiated SSL/TLS renegotiation vulnerability. This allows remote attackers to cause a denial of service by sending excessive renegotiation requests, which can consume CPU resources and render the authd service unavailable. The vulnerability can be mitigated by reviewing and updating Wazuh Manager to version 4.8.0 or later, implementing rate limiting on SSL/TLS renegotiation requests, and monitoring authd service for unusual activity and excessive CPU usage.

Defensive priority

Medium priority for Wazuh Manager administrators and security teams

Recommended defensive actions

• Review and update Wazuh Manager to version 4.8.0 or later
• Implement rate limiting on SSL/TLS renegotiation requests
• Monitor authd service for unusual activity and excessive CPU usage
• Verify Wazuh Manager version and configuration
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the improper restriction of client-initiated SSL/TLS renegotiation vulnerability in Wazuh Manager authd service. The vulnerability allows remote attackers to cause a denial of service by sending excessive renegotiation requests, consuming CPU resources and rendering the authd service unavailable.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.