CVE-2026-49392 wazuh CVE debrief

Who should care

Defenders responsible for Wazuh File Integrity Monitoring should assess exposure and apply patches. They should also review compensating controls for exposed systems, monitor for suspicious activity, and track exceptions. Security teams and vulnerability management teams should prioritize verifying exposure and applying patches for Wazuh versions 4.6.0 through 4.14.6 and 5.0.0-beta3.

Why it matters

Defenders should prioritize verifying exposure and applying patches for Wazuh versions 4.6.0 through 4.14.6 and 5.0.0-beta3 to prevent potential UNION SELECT injection attacks.

• A local user can manipulate SELECT result sets consumed by the FIM code.
• The primitive can inject a UNION SELECT expression when wazuh-syscheckd processes or deletes a monitored file path.

Technical summary

The DB::getFile() and DB::searchFile() functions in Wazuh's file.cpp concatenate a monitored file path into SQLite row filters. On non-Windows systems, FIMDBCreator::encodeString() does not escape the value, allowing a local user to inject a UNION SELECT expression. This issue is fixed in versions 4.14.6 and 5.0.0-beta3. Defenders should prioritize verifying exposure and applying patches for Wazuh versions 4.6.0 through 4.14.6 and 5.0.0-beta3 to prevent potential UNION SELECT injection attacks. The vulnerability allows a local user to manipulate SELECT result sets consumed by the FIM code.

Defensive priority

Defenders should prioritize verifying exposure and applying patches for Wazuh versions 4.6.0 through 4.14.6 and 5.0.0-beta3.

Recommended defensive actions

• Verify Wazuh version and check if it is within the affected range
• Apply patches for Wazuh versions 4.14.6 and 5.0.0-beta3
• Monitor File Integrity Monitoring directories for suspicious activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD vulnerability detail provide information on the issue, affected versions, and fixed versions. The vulnerability allows a local user to inject a UNION SELECT expression when wazuh-syscheckd processes or deletes a monitored file path. The confirmed primitive manipulates SELECT result sets consumed by the FIM code; stacked statements and remote code execution were not demonstrated. Evidence limits suggest verifying exposure and applying patches for Wazuh versions 4.6.0 through 4.14.6 and 5.0.0-beta3.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.