Is CVE-2026-40106 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-40106 being exploited in the wild.

How severe is CVE-2026-40106?

Medium severity, with a CVSS score of 4.7, published 17 July 2026.

Which products and versions are affected?

Wazuh Agent >= 4.6.0, < 4.14.5.

Is there a fix for CVE-2026-40106?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-40106 attacked?

It is attacked with local access, in an operating system.

Am I affected by CVE-2026-40106?

Check whether you run Wazuh Agent at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-40106: Wazuh Agent heap overflow in syscheck registry wildcard expansion

Q: Is there a fix for CVE-2026-40106?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is CVE-2026-40106 attacked?

It is attacked with local access, in an operating system.

Q: Am I affected by CVE-2026-40106?

Check whether you run Wazuh Agent at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-40106 · Severity: medium · CVSS 4.7 · Published 2026-07-17

Wazuh is a security platform used to monitor and protect computers from threats. A flaw in the Windows version of the Wazuh agent allows a standard user on a computer to crash the security software by creating a specially named registry key. This can be used to disable security monitoring on the device or potentially allow the user to gain full administrative control over the system.

Technologies: Wazuh Agent. Vendors: Wazuh.

Quick answers

Is CVE-2026-40106 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-40106 being exploited in the wild.
How severe is CVE-2026-40106?: Medium severity, with a CVSS score of 4.7, published 17 July 2026.
Which products and versions are affected?: Wazuh Agent >= 4.6.0, < 4.14.5.
Is there a fix for CVE-2026-40106?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-40106 attacked?: It is attacked with local access, in an operating system.
Am I affected by CVE-2026-40106?: Check whether you run Wazuh Agent at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A heap-based buffer overflow (CWE-122) exists in the syscheck component of the Wazuh agent for Windows within the w_expand_by_wildcard function in syscheck_op.c. The vulnerability occurs because the agent allocates a fixed 256-byte buffer (OS_SIZE_256) to store expanded registry paths but fails to validate the length of the resulting string when processing wildcards (* or ?). A local attacker with low privileges can create a registry subkey with the maximum allowed length (255 characters) in a monitored path, causing an out-of-bounds write during string concatenation. Because the agent runs with NT AUTHORITY\SYSTEM privileges, this can result in a Denial of Service (DoS) via process crash or potential Local Privilege Escalation (LPE). The issue is fixed in version 4.14.5.

Affected products

Wazuh Wazuh Agent >= 4.6.0, < 4.14.5

Timeline

2026-07-16: advisory: GitHub Security Advisory GHSA-qvrc-pcfc-jhqc published
2026-07-17: disclosed: NVD publication date

References

https://github.com/wazuh/wazuh/security/advisories/GHSA-qvrc-pcfc-jhqc

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.