Is CVE-2026-49392 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-49392 being exploited in the wild.

How severe is CVE-2026-49392?

Medium severity, with a CVSS score of 5.3, published 19 August 2026.

Which products and versions are affected?

Wazuh 4.6.0 to 4.14.6 (fixed in 4.14.6), 5.0.0-beta3 and earlier (fixed in 5.0.0-beta3).

Is there a fix for CVE-2026-49392?

A patch was published on 2026-05-25: Fix committed; patches released in versions 4.14.6 and 5.0.0-beta3 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-49392 attacked?

It is attacked with local access.

Am I affected by CVE-2026-49392?

Check whether you run Wazuh at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-49392: Wazuh SQL injection in File Integrity Monitoring database queries

CVE-2026-49392 · Severity: medium · CVSS 5.3 · Published 2026-08-19

Wazuh is an open-source threat detection and response platform that monitors file integrity across systems. A local attacker who can create files in monitored directories can inject SQL commands through specially crafted filenames, potentially manipulating which files and integrity checks are reported to security teams. While remote code execution was not confirmed, this could allow an attacker to hide evidence of tampering or exfiltration from security monitoring.

Technologies: Wazuh. Vendors: Wazuh.

Quick answers

Is CVE-2026-49392 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-49392 being exploited in the wild.
How severe is CVE-2026-49392?: Medium severity, with a CVSS score of 5.3, published 19 August 2026.
Which products and versions are affected?: Wazuh 4.6.0 to 4.14.6 (fixed in 4.14.6), 5.0.0-beta3 and earlier (fixed in 5.0.0-beta3).
Is there a fix for CVE-2026-49392?: A patch was published on 2026-05-25: Fix committed; patches released in versions 4.14.6 and 5.0.0-beta3 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-49392 attacked?: It is attacked with local access.
Am I affected by CVE-2026-49392?: Check whether you run Wazuh at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a SQL injection flaw in Wazuh's File Integrity Monitoring (FIM) component, specifically in DB::getFile() and DB::searchFile() functions within src/syscheckd/src/db/src/file.cpp. On non-Windows systems, FIMDBCreator::encodeString() fails to properly escape user-controlled file paths before inserting them into SQLite row filter queries. A local attacker can create a filename containing UNION SELECT expressions; when wazuh-syscheckd processes or deletes this path, the injected SQL is executed. The confirmed impact is manipulation of SELECT result sets consumed by the FIM code. The vulnerability requires local file creation capability in a monitored directory. Patches were released in versions 4.14.6 and 5.0.0-beta3, migrating affected queries to parameterized statements.

Affected products

Wazuh Wazuh 4.6.0 to 4.14.6 (fixed in 4.14.6), 5.0.0-beta3 and earlier (fixed in 5.0.0-beta3)

Timeline

2026-08-19: disclosed
2026-05-25: patched: Fix committed; patches released in versions 4.14.6 and 5.0.0-beta3

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.