What’s Vulnerable › Vulnerabilities

CVE-2026-74035: Wazuh 4.6.0 before 4.14.8 Authentication Bypass via Empty Password in update_user

• Severity: high (CVSS 7.2 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-13 · updated 2026-10-13
• Weakness: CWE-863

Description

Wazuh versions from 4.6.0 before 4.14.8 contain an authentication bypass vulnerability where security.update_user places the reserved user guard and password policy inside a falsy truthiness check. A delegated user administrator can send an empty password to the user update endpoint, bypassing the reserved user guard to take over the wazuh superuser account and authenticate with empty credentials.

Affected products

• wazuh: from 4.6.0 before 4.14.8 — fixed in 4.14.8

How to fix

Upgrade to a fixed version: wazuh 4.14.8. Check the vendor advisory for mitigations.

References

• https://github.com/wazuh/wazuh/releases/tag/v4.14.8
• https://github.com/wazuh/wazuh/security/advisories/GHSA-27gv-q7q6-f5qh
• https://www.vulncheck.com/advisories/wazuh-4.6.0-before-4.14.8-authentication-bypass-via-empty-password-in-update-user

Get alerted when CVE-2026-74035 or the next vulnerability affects your stack