Is CVE-2026-74046 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-74046 being exploited in the wild.

How severe is CVE-2026-74046?

Medium severity, with a CVSS score of 4.9, published 18 August 2026.

Which products and versions are affected?

Wazuh Manager 4.4.0 before 4.14.7.

Is there a fix for CVE-2026-74046?

A patch was published on 2026-06-25: Fix merged in PR #37119 to 4.14.7 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-74046 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-74046?

Check whether you run Wazuh or Wazuh Manager at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-74046: Wazuh denial of service via decompression bomb in cluster archive processing

CVE-2026-74046 · Severity: medium · CVSS 4.9 · Published 2026-08-18

Wazuh, an open-source security monitoring platform used to collect and analyze logs across enterprise infrastructure, contains a flaw that allows authenticated cluster members to cause memory exhaustion on the master node. An attacker with the cluster encryption key can upload a specially crafted compressed archive that decompresses to a very large size in memory, overwhelming the master node and disrupting security monitoring operations.

Technologies: Wazuh, Wazuh Manager. Vendors: Wazuh.

Quick answers

Is CVE-2026-74046 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-74046 being exploited in the wild.
How severe is CVE-2026-74046?: Medium severity, with a CVSS score of 4.9, published 18 August 2026.
Which products and versions are affected?: Wazuh Manager 4.4.0 before 4.14.7.
Is there a fix for CVE-2026-74046?: A patch was published on 2026-06-25: Fix merged in PR #37119 to 4.14.7 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-74046 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-74046?: Check whether you run Wazuh or Wazuh Manager at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a decompression bomb attack in the fdecompress_files() function (cluster.py, lines 490–510). The receiver calls zlib.decompress(content) on each archive member without enforcing a maximum decompressed size, allowing an authenticated peer to upload a small, highly compressed payload that expands to gigabytes in memory. The attack requires a valid cluster Fernet key and network access to the master cluster port (default TCP/1516). An attacker can achieve a compression amplification ratio of roughly 1000:1, causing a 510 KB wire input to allocate 1+ GiB transient heap on the master node and trigger denial of service through memory exhaustion. The fix (merged in PR #37119) bounds the decompressed size during sync archive processing.

Affected products

Wazuh wazuh-manager 4.4.0 before 4.14.7

Timeline

2026-08-18: disclosed: CVE-2026-74046 published; GHSA-mr7j-w2m4-vw5j advisory released
2026-06-25: patched: Fix merged in PR #37119 to 4.14.7
2026-08-18: other: Advisory published after patch availability

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.