CVE-2026-49392 wazuh CVE debrief

Who should care

Defenders responsible for Wazuh deployments, particularly those using File Integrity Monitoring, should assess exposure and prioritize patching. They should also monitor FIM directories and restrict access to prevent exploitation. Additionally, defenders should review compensating controls for exposed systems and track exceptions.

Why it matters

A local user can inject a UNION SELECT expression in Wazuh File Integrity Monitoring, allowing manipulation of SELECT result sets. Defenders should prioritize verifying and applying patches for affected versions, monitor FIM directories, and restrict access to prevent exploitation.

• Local users can manipulate SELECT result sets consumed by the FIM code
• Verification of affected versions and patch application is necessary
• Monitoring and restricting access to File Integrity Monitoring directories can help prevent exploitation

Technical summary

The DB::getFile() and DB::searchFile() functions in Wazuh's file.cpp concatenate monitored file paths into SQLite row filters without proper escaping on non-Windows systems, allowing a local user to inject a UNION SELECT expression. This issue is fixed in versions 4.14.6 and 5.0.0-beta3. The vulnerability allows manipulation of SELECT result sets consumed by the FIM code. Defenders should prioritize verifying and applying patches for Wazuh versions 4.6.0 through 4.14.6 and 5.0.0-beta3, monitoring FIM directories, and restricting access to prevent exploitation.

Defensive priority

Defenders should prioritize verifying and applying patches for Wazuh versions 4.6.0 through 4.14.6 and 5.0.0-beta3.

Recommended defensive actions

• Verify and apply patches for Wazuh versions 4.6.0 through 4.14.6 and 5.0.0-beta3
• Monitor File Integrity Monitoring directories for suspicious file creations
• Restrict access to File Integrity Monitoring directories to prevent local users from creating malicious filenames
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including source references such as commits, pull requests, and release tags. These references include Commit 8e4e25b971dfb7b15bc492f10f8a350e6b37e70e, Pull request 36399, and Wazuh release tag v4.14.6. The confirmed primitive manipulates SELECT result sets consumed by the FIM code; stacked statements and remote code execution were not demonstrated.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.