PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-32984 Wazuh CVE debrief

A heap-buffer overflow vulnerability exists in Wazuh's authentication daemon (authd). The flaw allows remote attackers to send specially crafted input that causes memory corruption and malformed heap data. Successful exploitation results in a denial of service condition affecting availability of the authentication service. The vulnerability is rated MEDIUM severity with a CVSS score of 5.3. Affected versions include Wazuh up to 3.5.0 and version 4.3.10 specifically. The underlying weakness is identified as CWE-125 (Out-of-bounds Read). The CVE was published on March 27, 2026 and last modified on May 26, 2026. No known exploitation in ransomware campaigns has been documented, and the vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog.

Vendor
Wazuh
Product
Unknown
CVSS
MEDIUM 5.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-03-27
Original CVE updated
2026-05-26
Advisory published
2026-03-27
Advisory updated
2026-05-26

Who should care

Security teams operating Wazuh security monitoring platforms, system administrators managing Wazuh agent authentication infrastructure, and organizations relying on Wazuh for endpoint detection and response should prioritize assessment and patching. Network defenders responsible for availability of security infrastructure services should monitor for potential denial of service conditions affecting authentication capabilities.

Technical summary

The vulnerability resides in Wazuh's authentication daemon (authd), where improper handling of specially crafted input leads to a heap-buffer overflow. This memory safety issue causes heap data corruption and can trigger daemon crashes, resulting in denial of service. The attack requires network access to the authd service and user interaction, with low complexity for exploitation. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L) reflects network accessibility, no privilege requirements, user interaction dependency, and low availability impact. The vulnerability is classified under CWE-125 (Out-of-bounds Read).

Defensive priority

medium

Recommended defensive actions

  • Review Wazuh authd configurations and assess exposure of authentication daemon to untrusted networks
  • Apply vendor patches or updates addressing CVE-2026-32984 when available from Wazuh
  • Monitor Wazuh authd process stability and logs for anomalous termination or memory-related errors
  • Consider network segmentation to limit access to Wazuh authd service
  • Review VulnCheck advisory for additional technical details and mitigation guidance

Evidence notes

The NVD record identifies affected CPE configurations including wazuh:wazuh versions up to 3.5.0 and specifically version 4.3.10. The CVSS 4.0 vector indicates network attack vector with low attack complexity, no privileges required, and user interaction required. Availability impact is rated low. The weakness enumeration cites CWE-125 from [email protected] as a secondary source.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-32984 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-32984

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-32984 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-32984

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.