Quick answers
- Is CVE-2026-93346 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-93346 being exploited in the wild.
- How severe is CVE-2026-93346?
- Medium severity, with a CVSS score of 5.3, published 13 October 2026.
- Which products and versions are affected?
- Wazuh Manager 4.0.0 before 4.14.8.
- Is there a fix for CVE-2026-93346?
- Yes: fixed in 4.14.8. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-93346 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-93346?
- Check whether you run Wazuh Manager at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: 4.14.8
Technical details
A time-of-check/time-of-use race condition exists between the CheckBlockedIP middleware (which checks if an IP is blocked at request start) and the prevent_bruteforce_attack error handler (which increments the failure counter only after credential validation completes). Because credential validation is asynchronous and yields the event loop, a burst of concurrent login requests all pass the block check before any failures are recorded, defeating the max_login_attempts throttle. An attacker can evaluate an arbitrary number of password guesses in a single concurrent burst, limited only by request concurrency rather than the configured attempt threshold.
Affected products
- Wazuh Wazuh Manager 4.0.0 before 4.14.8
Timeline
- 2026-10-13: disclosed