CVE-2026-74046 Wazuh CVE debrief

Who should care

Wazuh cluster administrators and security teams should assess exposure and prioritize remediation due to the potential for denial of service attacks. They should verify Wazuh cluster configurations, review synchronization archives, and upgrade to version 4.14.7 or later to mitigate this vulnerability. Security teams must consider the impact on their vulnerability management processes and ensure that appropriate compensating controls are in place.

Why it matters

CVE-2026-74046 is a denial of service vulnerability in Wazuh 4.4.0 before 4.14.7 that allows authenticated cluster peers to exhaust memory by supplying a malicious synchronization archive. Defenders should prioritize verifying Wazuh cluster configurations, reviewing synchronization archives, and upgrading to version 4.14.7 or later to mitigate this vulnerability.

• Memory exhaustion leading to service disruption
• Potential for denial of service attacks
• Need for verification of Wazuh cluster configurations
• Importance of upgrading to version 4.14.7 or later

Technical summary

The fdecompress_files() function in Wazuh cluster.py does not enforce decompressed size limits for synchronization archives. Authenticated cluster peers can exploit this by uploading a small, highly compressed zip bomb archive, causing wazuh-clusterd on the master node to decompress the full payload into memory, leading to memory exhaustion and service disruption. This vulnerability affects Wazuh 4.4.0 before 4.14.7, and defenders should prioritize verifying cluster configurations and upgrading to the fixed version.

Defensive priority

Defenders should prioritize verifying Wazuh cluster configurations, reviewing synchronization archives, and upgrading to version 4.14.7 or later to mitigate this vulnerability.

Recommended defensive actions

• Verify Wazuh cluster configurations to ensure synchronization archives are validated and decompressed size limits are enforced.
• Review and restrict upload of synchronization archives to prevent malicious payloads.
• Upgrade to Wazuh version 4.14.7 or later to apply the fix.
• Monitor Wazuh cluster nodes for memory exhaustion and service disruption.
• Implement additional security controls to detect and prevent zip bomb attacks.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and affected versions. Vendor advisories and issue tracking links are also available. Evidence limits suggest verifying Wazuh cluster configurations, reviewing synchronization archives, and upgrading to version 4.14.7 or later. Defenders should validate affected scope and severity with official advisories.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.