CVE-2026-74046 Wazuh CVE debrief

Who should care

Defenders responsible for Wazuh deployments, particularly those using Wazuh clusters, should assess their exposure to this vulnerability and prioritize verification and remediation efforts.

Why it matters

CVE-2026-74046 is a denial of service vulnerability in Wazuh 4.4.0 before 4.14.7 that allows authenticated cluster peers to exhaust memory, potentially leading to service disruption. Defenders responsible for Wazuh deployments should assess their exposure, verify cluster configurations, and prioritize remediation efforts.

• Memory exhaustion and service disruption in Wazuh clusters.
• Potential for attackers to leverage this vulnerability for denial of service attacks.
• Need for verification of Wazuh cluster configurations and authentication controls.
• Priority for updating Wazuh deployments to the latest version.

Technical summary

The fdecompress_files() function in Wazuh 4.4.0 before 4.14.7 contains a denial of service vulnerability that allows authenticated cluster peers to exhaust memory by supplying a malicious synchronization archive without decompressed size limits. This vulnerability can be exploited by attackers with a valid cluster Fernet key to upload a small, highly compressed zip bomb archive that forces wazuh-clusterd on the master node to decompress the full payload into memory, causing memory exhaustion and service disruption. Defenders should prioritize verifying Wazuh cluster configurations, reviewing authentication and authorization controls for cluster peers, and ensuring that the latest version of Wazuh is deployed to

Defensive priority

Defenders should prioritize verifying Wazuh cluster configurations, reviewing authentication and authorization controls for cluster peers, and ensuring that the latest version of Wazuh is deployed to mitigate potential memory exhaustion attacks.

Recommended defensive actions

• Verify Wazuh cluster configurations to ensure proper authentication and authorization controls are in place.
• Review and update Wazuh deployments to ensure the latest version is used.
• Monitor Wazuh cluster nodes for signs of memory exhaustion and service disruption.
• Implement compensating controls to limit the impact of potential memory exhaustion attacks.
• Review Wazuh cluster authentication controls to prevent unauthorized access.
• Perform asset inventory of Wazuh deployments to identify potential exposure.
• Track exceptions and retest remediated Wazuh cluster nodes.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and affected versions. Additional information is available from source references, including GitHub pull requests and Vulncheck advisories.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.