# Wazuh Manager vulnerabilities Source: https://junglewise.ai/threats/technologies/wazuh-manager Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/wazuh-manager.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 31 vulnerabilities in Wazuh Manager: 4 in the last 7 days and 24 in the last 90 days, 4 of them critical and 0 exploited in the wild. The most recent, CVE-2026-112341, was published on 6 November 2026. 18 vulnerabilities in the last four weeks, up from none in the four before. 3 critical against 0. ## Counts - Last 7 days: 4 - Last 30 days: 4 - Last 90 days: 24 - All time: 31 (4 critical, 0 exploited in the wild) ## About Wazuh Manager The central component of the Wazuh platform responsible for analyzing data from agents and triggering alerts. ## Latest Wazuh Manager vulnerabilities - [CVE-2026-112341: Wazuh Manager SQL injection in WazuhDBBackend._substitute_params](https://junglewise.ai/threats/cve-2026-112341-wazuh-versions-from-4-0-0-before-4-14-9-contain-a-sql-injection) (medium, CVSS 6.5, published 6 Nov 2026) - [CVE-2026-112339: Wazuh missing TLS hostname verification in fluent-forward module](https://junglewise.ai/threats/cve-2026-112339-wazuh-from-3-9-0-before-4-14-9-contains-a-missing-tls-hostname) (medium, CVSS 5.9, published 6 Nov 2026) - [CVE-2026-112338: Wazuh GitHub module server-side request forgery in pagination](https://junglewise.ai/threats/cve-2026-112338-wazuh-from-4-3-0-before-4-14-9-contains-a-server-side-request) (medium, CVSS 5.9, published 6 Nov 2026) - [CVE-2026-112336: Wazuh Manager memory leak in JSON decoder](https://junglewise.ai/threats/cve-2026-112336-wazuh-manager-from-3-0-0-before-4-14-9-contains-a-memory-leak) (medium, CVSS 6.5, published 6 Nov 2026) - [CVE-2026-93347: Wazuh path traversal in get_list_file helper](https://junglewise.ai/threats/cve-2026-93347-wazuh-from-4-1-1-before-4-14-8-contains-a-path-traversal) (medium, CVSS 4.9, published 13 Oct 2026) - [CVE-2026-93346: Wazuh API login throttling race condition](https://junglewise.ai/threats/cve-2026-93346-wazuh-from-4-0-0-before-4-14-8-contains-a-race-condition-in-api) (medium, CVSS 5.3, published 13 Oct 2026) - [CVE-2026-74047: Wazuh information disclosure via agent config endpoint](https://junglewise.ai/threats/cve-2026-74047-wazuh-from-4-0-0-before-4-14-8-contains-an-information-disclosure) (medium, CVSS 6.5, published 13 Oct 2026) - [CVE-2026-74045: Wazuh heap buffer overflow in fim_generate_alert()](https://junglewise.ai/threats/cve-2026-74045-wazuh-from-3-12-0-before-4-14-8-contains-a-heap-buffer-overflow) (high, CVSS 7.1, published 13 Oct 2026) - [CVE-2026-74043: Wazuh path traversal in cluster upload functions](https://junglewise.ai/threats/cve-2026-74043-wazuh-from-4-1-1-before-4-14-8-contains-a-path-traversal) (critical, CVSS 9, published 13 Oct 2026) - [CVE-2026-74041: Wazuh case-sensitivity mismatch in remote-command validation](https://junglewise.ai/threats/cve-2026-74041-wazuh-4-14-3-before-4-14-8-contains-a-case-sensitivity-mismatch) (critical, CVSS 9.1, published 13 Oct 2026) - [CVE-2026-74040: Wazuh arbitrary file overwrite in cluster worker communication](https://junglewise.ai/threats/cve-2026-74040-wazuh-versions-from-3-9-0-before-4-14-8-contain-an-arbitrary-file) (critical, CVSS 9.1, published 13 Oct 2026) - [CVE-2026-74037: Wazuh token invalidation bypass in run_as users](https://junglewise.ai/threats/cve-2026-74037-wazuh-4-0-0-before-4-14-8-fails-to-invalidate-issued-tokens-for) (high, CVSS 7.2, published 13 Oct 2026) - [CVE-2026-74035: Wazuh authentication bypass in security.update_user](https://junglewise.ai/threats/cve-2026-74035-wazuh-versions-from-4-6-0-before-4-14-8-contain-an-authentication) (high, CVSS 7.2, published 13 Oct 2026) - [CVE-2026-74034: Wazuh missing origin check in agent upgrade allows arbitrary file read](https://junglewise.ai/threats/cve-2026-74034-wazuh-from-4-1-0-before-4-14-8-contains-a-missing-origin-check-in) (high, CVSS 7.5, published 13 Oct 2026) - [CVE-2026-74033: Wazuh path traversal in CDB list handlers](https://junglewise.ai/threats/cve-2026-74033-wazuh-from-4-1-1-before-4-14-8-contains-a-path-traversal) (medium, CVSS 6.1, published 13 Oct 2026) - [CVE-2026-74032: Wazuh authorization bypass in RBAC API endpoints](https://junglewise.ai/threats/cve-2026-74032-wazuh-from-4-0-0-before-4-14-8-contains-an-authorization-bypass) (medium, CVSS 4.3, published 13 Oct 2026) - [CVE-2026-74031: Wazuh path traversal in rule and decoder deletion helpers](https://junglewise.ai/threats/cve-2026-74031-wazuh-from-4-1-1-before-4-14-8-contains-a-path-traversal) (medium, CVSS 6.5, published 13 Oct 2026) - [CVE-2026-74030: Wazuh YAML alias expansion memory exhaustion in SCA](https://junglewise.ai/threats/cve-2026-74030-wazuh-from-3-9-0-before-4-14-8-contains-an-uncontrolled-yaml) (medium, CVSS 4.9, published 13 Oct 2026) - [CVE-2026-61802: Wazuh cluster key disclosure in GET /cluster/local/config](https://junglewise.ai/threats/cve-2026-61802-wazuh-cluster-key-disclosure-in-get-cluster-local-config) (medium, CVSS 6.5, published 28 Aug 2026) - [CVE-2026-61783: Wazuh authentication bypass in config masking via RBAC](https://junglewise.ai/threats/cve-2026-61783-wazuh-authentication-bypass-in-config-masking-via-rbac) (medium, CVSS 6.5, published 28 Aug 2026) - [CVE-2026-54085: Wazuh active response argument injection in firewall and account scripts](https://junglewise.ai/threats/cve-2026-54085-wazuh-active-response-argument-injection-in-firewall-and-account) (high, CVSS 7.1, published 28 Aug 2026) - [CVE-2026-74046: Wazuh denial of service via decompression bomb in cluster archive processing](https://junglewise.ai/threats/cve-2026-74046-wazuh-denial-of-service-via-decompression-bomb-in-cluster-archive) (medium, CVSS 4.9, published 18 Aug 2026) - [CVE-2026-74044: Wazuh path traversal in cluster node name validation](https://junglewise.ai/threats/cve-2026-74044-wazuh-path-traversal-in-cluster-node-name-validation) (medium, CVSS 6.5, published 18 Aug 2026) - [CVE-2026-74039: Wazuh API denial of service via deeply nested JSON](https://junglewise.ai/threats/cve-2026-74039-wazuh-api-denial-of-service-via-deeply-nested-json) (medium, CVSS 6.5, published 18 Aug 2026) - [CVE-2026-44251: Wazuh Manager integer underflow in os_crypto message processing](https://junglewise.ai/threats/cve-2026-44251-wazuh-manager-integer-underflow-in-os-crypto-message-processing) (medium, CVSS 6.5, published 17 Jul 2026) ## Most severe Wazuh Manager vulnerabilities - [CVE-2026-56699: Wazuh Manager NDJSON injection in inventory_sync](https://junglewise.ai/threats/cve-2026-56699-wazuh-manager-ndjson-injection-in-inventory-sync) (critical, CVSS 10, published 15 Jul 2026) - [CVE-2026-74040: Wazuh arbitrary file overwrite in cluster worker communication](https://junglewise.ai/threats/cve-2026-74040-wazuh-versions-from-3-9-0-before-4-14-8-contain-an-arbitrary-file) (critical, CVSS 9.1, published 13 Oct 2026) - [CVE-2026-74041: Wazuh case-sensitivity mismatch in remote-command validation](https://junglewise.ai/threats/cve-2026-74041-wazuh-4-14-3-before-4-14-8-contains-a-case-sensitivity-mismatch) (critical, CVSS 9.1, published 13 Oct 2026) - [CVE-2026-74043: Wazuh path traversal in cluster upload functions](https://junglewise.ai/threats/cve-2026-74043-wazuh-from-4-1-1-before-4-14-8-contains-a-path-traversal) (critical, CVSS 9, published 13 Oct 2026) - [CVE-2026-74034: Wazuh missing origin check in agent upgrade allows arbitrary file read](https://junglewise.ai/threats/cve-2026-74034-wazuh-from-4-1-0-before-4-14-8-contains-a-missing-origin-check-in) (high, CVSS 7.5, published 13 Oct 2026) - [CVE-2026-39359: Wazuh Manager path traversal in authd and remoted daemons](https://junglewise.ai/threats/cve-2026-39359-wazuh-manager-path-traversal-in-authd-and-remoted-daemons) (high, CVSS 7.5, published 17 Jul 2026) - [CVE-2026-34150: Wazuh Manager heap buffer overflow in wazuh-analysisd](https://junglewise.ai/threats/cve-2026-34150-wazuh-manager-heap-buffer-overflow-in-wazuh-analysisd) (high, CVSS 7.5, published 17 Jul 2026) - [CVE-2026-74035: Wazuh authentication bypass in security.update_user](https://junglewise.ai/threats/cve-2026-74035-wazuh-versions-from-4-6-0-before-4-14-8-contain-an-authentication) (high, CVSS 7.2, published 13 Oct 2026) - [CVE-2026-74037: Wazuh token invalidation bypass in run_as users](https://junglewise.ai/threats/cve-2026-74037-wazuh-4-0-0-before-4-14-8-fails-to-invalidate-issued-tokens-for) (high, CVSS 7.2, published 13 Oct 2026) - [CVE-2026-54085: Wazuh active response argument injection in firewall and account scripts](https://junglewise.ai/threats/cve-2026-54085-wazuh-active-response-argument-injection-in-firewall-and-account) (high, CVSS 7.1, published 28 Aug 2026) ## Vulnerabilities per week 18 vulnerabilities in the last four weeks, up from none in the four before. 3 critical against 0. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 3 | 0 | 0 | | 24 Aug 2026 | 3 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 14 | 3 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 4 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other Wazuh technologies - [Wazuh](https://junglewise.ai/threats/technologies/wazuh): 50 vulnerabilities - [Wazuh Agent](https://junglewise.ai/threats/technologies/wazuh-agent): 8 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Wazuh Manager vulnerabilities", https://junglewise.ai/threats/technologies/wazuh-manager, 13 November 2026.