CVE-2026-74039 Wazuh CVE debrief

Who should care

Wazuh administrators, security teams, and API consumers should assess exposure and prioritize verification or mitigation efforts. This includes reviewing Wazuh deployment versions and configurations, monitoring API consumer performance and CPU resource utilization, and considering updates or mitigations to prevent exploitation.

Why it matters

CVE-2026-74039 is a high-severity denial of service vulnerability in Wazuh, allowing authenticated attackers to exhaust CPU resources. Defenders should verify exposure, especially in Wazuh deployments with allow_run_as enabled, and prioritize updates or mitigations.

• Potential CPU resource exhaustion impacting API consumers
• Denial of service to all other API consumers
• Need for verification of Wazuh deployment versions and configurations
• Possible need for updates or mitigations to prevent exploitation

Technical summary

The vulnerability allows authenticated attackers with allow_run_as enabled to submit deeply nested JSON structures to the POST /security/user/authenticate/run_as endpoint, causing excessive CPU consumption and denying service to other API consumers. This can be achieved by repeatedly submitting malformed auth_context bodies with unlimited nesting depth. The vulnerability affects Wazuh 4.0.0 before 4.14.7 and 5.0.0-beta2, and defenders should prioritize verifying exposure, especially for Wazuh deployments with allow_run_as enabled.

Defensive priority

Defenders should prioritize verifying exposure, especially for Wazuh deployments with allow_run_as enabled, and assess the need for updates or mitigations.

Recommended defensive actions

• Verify Wazuh deployment versions and configurations to assess exposure
• Review and limit the use of allow_run_as where possible
• Monitor API consumer performance and CPU resource utilization
• Consider updating to Wazuh 4.14.7 or later, or 5.0.0-beta3 or later
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, affected versions, and potential impacts. Vendor advisories and issue tracking links offer additional context. The vulnerability has been publicly disclosed and defenders should verify exposure, especially in Wazuh deployments with allow_run_as enabled. Limited source detail is available, so defenders should exercise caution and verify information through official channels.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.