# CVE-2026-54084: Wazuh agent NULL pointer dereference in enrollment

Source: https://junglewise.ai/threats/cve-2026-54084-wazuh-agent-null-pointer-dereference-in-enrollment  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-28. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-54084 · Severity: medium · CVSS 5.3 · Published 2026-08-28

Wazuh is an open-source security platform used to monitor and protect endpoints and cloud workloads. An attacker operating a rogue enrollment manager or intercepting enrollment traffic can crash Wazuh agents by sending a malformed enrollment response, causing service disruption. This attack requires no credentials and succeeds even in default deployments where agent-to-manager encryption is not configured.

Technologies: [Wazuh](https://junglewise.ai/threats/technologies/wazuh). Vendors: [Wazuh](https://junglewise.ai/threats/vendors/wazuh).

## Quick answers

**Is CVE-2026-54084 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-54084 being exploited in the wild.

**How severe is CVE-2026-54084?** Medium severity, with a CVSS score of 5.3, published 28 August 2026.

**Which products and versions are affected?** Wazuh 4.0.0 through 4.14.6.

**Is there a fix for CVE-2026-54084?** A patch was published on 2026-08-28: Version 4.14.7 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-54084 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-54084?** Check whether you run Wazuh at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a NULL pointer dereference in the enrollment key validation logic (w_enrollment_process_agent_key in src/shared/enrollment_op.c). When the enrollment manager response contains fewer than four space-separated fields, the OS_StrBreak() function leaves trailing array entries as NULL, but the downstream validator OS_IsValidName() calls strlen() on its argument without checking for NULL. An attacker can send a malformed response like "OSSEC K:'1'" that passes the first validation (ID check) but crashes when the second validator attempts to validate a NULL pointer. The vulnerability requires network access to the agent's enrollment flow and affects versions 4.0.0 through 4.14.6; a fix was released in version 4.14.7 that adds NULL field validation before calling validators.

## Affected products

- Wazuh Wazuh 4.0.0 through 4.14.6

## Timeline

- 2026-08-28: disclosed
- 2026-08-28: patched: Version 4.14.7

## References

- [https://github.com/wazuh/wazuh/commit/7dfbb4a292bc6ae8e3bb4c1982f687f35216a748](https://github.com/wazuh/wazuh/commit/7dfbb4a292bc6ae8e3bb4c1982f687f35216a748)
- [https://github.com/wazuh/wazuh/security/advisories/GHSA-ppc7-hj9v-vx39](https://github.com/wazuh/wazuh/security/advisories/GHSA-ppc7-hj9v-vx39)

## Related threats

- [Wazuh heap buffer overflow in Windows EventChannel decoder](https://junglewise.ai/threats/cve-2026-62365-wazuh-is-an-open-source-security-platform-providing-unified-xdr)
- [Wazuh unauthenticated memory exhaustion in cluster listener](https://junglewise.ai/threats/cve-2026-71540-wazuh-is-an-open-source-security-platform-providing-unified-xdr)
- [Wazuh stack exhaustion in XML parser via element attributes](https://junglewise.ai/threats/cve-2026-61811-wazuh-is-an-open-source-security-platform-providing-unified-xdr)
- [Wazuh cluster key disclosure in GET /cluster/local/config](https://junglewise.ai/threats/cve-2026-61802-wazuh-cluster-key-disclosure-in-get-cluster-local-config)
- [Wazuh arbitrary file write in cluster worker file sync](https://junglewise.ai/threats/cve-2026-61800-wazuh-arbitrary-file-write-in-cluster-worker-file-sync)