# CVE-2026-74035: Wazuh authentication bypass in security.update_user

Source: https://junglewise.ai/threats/cve-2026-74035-wazuh-versions-from-4-6-0-before-4-14-8-contain-an-authentication  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-13. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-74035 · Severity: high · CVSS 7.2 · Published 2026-10-13

Wazuh is a security monitoring platform used to detect threats and manage compliance across infrastructure. A vulnerability in versions 4.6.0 through 4.14.7 allows an administrator with limited user-management permissions to set an empty password on the superuser account, bypassing intended password policies and security controls. An attacker can then log in as the superuser with no password, gaining complete control of the system.

Technologies: [Wazuh Manager](https://junglewise.ai/threats/technologies/wazuh-manager). Vendors: [Wazuh](https://junglewise.ai/threats/vendors/wazuh).

## Quick answers

**Is CVE-2026-74035 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-74035 being exploited in the wild.

**How severe is CVE-2026-74035?** High severity, with a CVSS score of 7.2, published 13 October 2026.

**Which products and versions are affected?** Wazuh Manager 4.6.0 through 4.14.7.

**Is there a fix for CVE-2026-74035?** Yes: fixed in 4.14.8. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-74035 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-74035?** Check whether you run Wazuh Manager at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 4.14.8

## Technical details

The vulnerability exists in framework/wazuh/security.py where the update_user function wraps password validation and the reserved user guard inside a falsy truthiness check (if password:). In Python, an empty string is falsy, so submitting {"password": ""} skips the length check, complexity check, and the guard that prevents modification of reserved accounts (user IDs 1–99). The empty string is then hashed and stored without further validation, making the superuser account accessible via HTTP Basic Authentication with empty credentials (base64("wazuh:")).

## Affected products

- Wazuh Wazuh Manager 4.6.0 through 4.14.7

## Timeline

- 2026-10-13: disclosed

## References

- [https://github.com/wazuh/wazuh/releases/tag/v4.14.8](https://github.com/wazuh/wazuh/releases/tag/v4.14.8)
- [https://github.com/wazuh/wazuh/security/advisories/GHSA-27gv-q7q6-f5qh](https://github.com/wazuh/wazuh/security/advisories/GHSA-27gv-q7q6-f5qh)

## Related threats

- [Wazuh Manager SQL injection in WazuhDBBackend._substitute_params](https://junglewise.ai/threats/cve-2026-112341-wazuh-versions-from-4-0-0-before-4-14-9-contain-a-sql-injection)
- [Wazuh missing TLS hostname verification in fluent-forward module](https://junglewise.ai/threats/cve-2026-112339-wazuh-from-3-9-0-before-4-14-9-contains-a-missing-tls-hostname)
- [Wazuh GitHub module server-side request forgery in pagination](https://junglewise.ai/threats/cve-2026-112338-wazuh-from-4-3-0-before-4-14-9-contains-a-server-side-request)
- [Wazuh Manager memory leak in JSON decoder](https://junglewise.ai/threats/cve-2026-112336-wazuh-manager-from-3-0-0-before-4-14-9-contains-a-memory-leak)
- [Wazuh path traversal in get_list_file helper](https://junglewise.ai/threats/cve-2026-93347-wazuh-from-4-1-1-before-4-14-8-contains-a-path-traversal)