CVE-2026-74035 Wazuh CVE debrief

Who should care

Wazuh administrators and users, security teams, and IT professionals responsible for maintaining and securing Wazuh installations should be aware of this vulnerability and take necessary actions to prevent potential exploitation.

Why it matters

CVE-2026-74035 is a high-severity authentication bypass vulnerability in Wazuh versions from 4.6.0 before 4.14.8. Defenders should prioritize verifying exposure and applying patches or mitigations to prevent potential authentication bypass. Wazuh administrators and users, security teams, and IT professionals responsible for maintaining and securing Wazuh installations should be aware of this vulnerability and take necessary actions.

• Potential authentication bypass and unauthorized access to Wazuh superuser account
• Possible elevation of privileges for attackers
• Increased risk of security breaches and data compromise
• Need for verification of Wazuh version and application of patches or mitigations

Technical summary

The vulnerability exists in the update_user function of Wazuh, where an authentication bypass can occur due to a falsy truthiness check. This allows a delegated user administrator to send an empty password to the user update endpoint, potentially bypassing the reserved user guard and taking over the Wazuh superuser account. The issue arises from inadequate validation of the password field, which can be exploited by an attacker to gain unauthorized access. Defenders should prioritize verifying exposure and applying patches or mitigations to prevent potential authentication bypass.

Defensive priority

Defenders should prioritize verifying exposure and applying patches or mitigations to prevent potential authentication bypass.

Recommended defensive actions

• Verify Wazuh version and check if it is within the affected range
• Apply patches or updates to Wazuh to prevent potential authentication bypass
• Monitor user update endpoint for suspicious activity
• Consider implementing additional security measures to protect against potential exploitation
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The vulnerability is described in the CVE record and source item. The affected versions and patch information are provided by the vendor and supplemental sources. Evidence is limited to CVE and vendor-provided information. Defenders should verify exposure by reviewing Wazuh version and applying patches or mitigations to prevent potential authentication bypass. The CVE record was published on 2026-10-13T13:27:28.652Z and has not been modified since then. No additional information is available beyond vendor-provided details.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.