# Wazuh vulnerabilities Source: https://junglewise.ai/threats/technologies/wazuh Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 12 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/wazuh.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 50 vulnerabilities in Wazuh: 0 in the last 7 days and 25 in the last 90 days, 5 of them critical and 0 exploited in the wild. The most recent, CVE-2026-62365, was published on 4 November 2026. 1 vulnerability in the last four weeks, down 50% on the four before (2). ## Counts - Last 7 days: 0 - Last 30 days: 1 - Last 90 days: 25 - All time: 50 (5 critical, 0 exploited in the wild) ## About Wazuh Wazuh is a free and open-source platform for threat detection, security monitoring, incident response, and compliance. ## Latest Wazuh vulnerabilities - [CVE-2026-62365: Wazuh heap buffer overflow in Windows EventChannel decoder](https://junglewise.ai/threats/cve-2026-62365-wazuh-is-an-open-source-security-platform-providing-unified-xdr) (medium, CVSS 5.3, published 4 Nov 2026) - [CVE-2026-71540: Wazuh unauthenticated memory exhaustion in cluster listener](https://junglewise.ai/threats/cve-2026-71540-wazuh-is-an-open-source-security-platform-providing-unified-xdr) (high, CVSS 7.5, published 24 Sep 2026) - [CVE-2026-61811: Wazuh stack exhaustion in XML parser via element attributes](https://junglewise.ai/threats/cve-2026-61811-wazuh-is-an-open-source-security-platform-providing-unified-xdr) (medium, CVSS 6.5, published 24 Sep 2026) - [CVE-2026-61802: Wazuh cluster key disclosure in GET /cluster/local/config](https://junglewise.ai/threats/cve-2026-61802-wazuh-cluster-key-disclosure-in-get-cluster-local-config) (medium, CVSS 6.5, published 28 Aug 2026) - [CVE-2026-61800: Wazuh arbitrary file write in cluster worker file sync](https://junglewise.ai/threats/cve-2026-61800-wazuh-arbitrary-file-write-in-cluster-worker-file-sync) (critical, CVSS 9.1, published 28 Aug 2026) - [CVE-2026-61783: Wazuh authentication bypass in config masking via RBAC](https://junglewise.ai/threats/cve-2026-61783-wazuh-authentication-bypass-in-config-masking-via-rbac) (medium, CVSS 6.5, published 28 Aug 2026) - [CVE-2026-54085: Wazuh active response argument injection in firewall and account scripts](https://junglewise.ai/threats/cve-2026-54085-wazuh-active-response-argument-injection-in-firewall-and-account) (high, CVSS 7.1, published 28 Aug 2026) - [CVE-2026-54084: Wazuh agent NULL pointer dereference in enrollment](https://junglewise.ai/threats/cve-2026-54084-wazuh-agent-null-pointer-dereference-in-enrollment) (medium, CVSS 5.3, published 28 Aug 2026) - [CVE-2026-54083: Wazuh ip-customblock path traversal in active response](https://junglewise.ai/threats/cve-2026-54083-wazuh-ip-customblock-path-traversal-in-active-response) (high, CVSS 8.1, published 28 Aug 2026) - [CVE-2026-49441: Wazuh path traversal in cluster file processing](https://junglewise.ai/threats/cve-2026-49441-wazuh-path-traversal-in-cluster-file-processing) (critical, CVSS 9.1, published 19 Aug 2026) - [CVE-2026-49392: Wazuh SQL injection in File Integrity Monitoring database queries](https://junglewise.ai/threats/cve-2026-49392-wazuh-sql-injection-in-file-integrity-monitoring-database-queries) (medium, CVSS 5.3, published 19 Aug 2026) - [CVE-2026-48162: Wazuh path traversal in cluster DAPI send_tmp_file](https://junglewise.ai/threats/cve-2026-48162-wazuh-path-traversal-in-cluster-dapi-send-tmp-file) (critical, CVSS 9.1, published 19 Aug 2026) - [CVE-2026-48024: Wazuh path traversal in cluster synchronization](https://junglewise.ai/threats/cve-2026-48024-wazuh-path-traversal-in-cluster-synchronization) (critical, CVSS 9.1, published 19 Aug 2026) - [CVE-2026-45798: Wazuh buffer over-read and stack corruption in version comparison](https://junglewise.ai/threats/cve-2026-45798-wazuh-buffer-over-read-and-stack-corruption-in-version-comparison) (high, CVSS 7.5, published 19 Aug 2026) - [CVE-2026-44901: Wazuh remote code execution in cluster merge](https://junglewise.ai/threats/cve-2026-44901-wazuh-remote-code-execution-in-cluster-merge) (high, CVSS 8.4, published 19 Aug 2026) - [CVE-2026-44256: Wazuh API log injection via unvalidated Basic auth username](https://junglewise.ai/threats/cve-2026-44256-wazuh-api-log-injection-via-unvalidated-basic-auth-username) (medium, CVSS 5.3, published 19 Aug 2026) - [CVE-2026-44255: Wazuh username enumeration via authentication timing attack](https://junglewise.ai/threats/cve-2026-44255-wazuh-username-enumeration-via-authentication-timing-attack) (medium, CVSS 5.3, published 19 Aug 2026) - [CVE-2026-41424: Wazuh authentication bypass in user password update](https://junglewise.ai/threats/cve-2026-41424-wazuh-authentication-bypass-in-user-password-update) (high, CVSS 8.2, published 19 Aug 2026) - [CVE-2026-46343: Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.0.0 until 4.14.6…](https://junglewise.ai/threats/cve-2026-46343-wazuh-is-a-free-and-open-source-platform-used-for-threat) (high, CVSS 7.2, published 19 Aug 2026) - [CVE-2026-44254: Wazuh is a free and open source platform used for threat prevention, detection, and response. From 1.0.0 until 4.14.6…](https://junglewise.ai/threats/cve-2026-44254-wazuh-is-a-free-and-open-source-platform-used-for-threat) (medium, CVSS 5.3, published 19 Aug 2026) - [CVE-2026-44253: Wazuh is a free and open source platform used for threat prevention, detection, and response. From 3.9.0 until 4.14.5…](https://junglewise.ai/threats/cve-2026-44253-wazuh-is-a-free-and-open-source-platform-used-for-threat) (medium, CVSS 4.9, published 19 Aug 2026) - [CVE-2026-44252: Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.0.0 until 4.14.5…](https://junglewise.ai/threats/cve-2026-44252-wazuh-is-a-free-and-open-source-platform-used-for-threat) (high, CVSS 8.8, published 19 Aug 2026) - [CVE-2026-74046: Wazuh denial of service via decompression bomb in cluster archive processing](https://junglewise.ai/threats/cve-2026-74046-wazuh-denial-of-service-via-decompression-bomb-in-cluster-archive) (medium, CVSS 4.9, published 18 Aug 2026) - [CVE-2026-74044: Wazuh path traversal in cluster node name validation](https://junglewise.ai/threats/cve-2026-74044-wazuh-path-traversal-in-cluster-node-name-validation) (medium, CVSS 6.5, published 18 Aug 2026) - [CVE-2026-74038: Wazuh 4.0.0 before 4.14.6 contains a path traversal vulnerability that allows unauthenticated remote attackers to…](https://junglewise.ai/threats/cve-2026-74038-wazuh-4-0-0-before-4-14-6-contains-a-path-traversal-vulnerability) (high, CVSS 7.1, published 18 Aug 2026) ## Most severe Wazuh vulnerabilities - [CVE-2026-61800: Wazuh arbitrary file write in cluster worker file sync](https://junglewise.ai/threats/cve-2026-61800-wazuh-arbitrary-file-write-in-cluster-worker-file-sync) (critical, CVSS 9.1, published 28 Aug 2026) - [CVE-2026-48024: Wazuh path traversal in cluster synchronization](https://junglewise.ai/threats/cve-2026-48024-wazuh-path-traversal-in-cluster-synchronization) (critical, CVSS 9.1, published 19 Aug 2026) - [CVE-2026-49441: Wazuh path traversal in cluster file processing](https://junglewise.ai/threats/cve-2026-49441-wazuh-path-traversal-in-cluster-file-processing) (critical, CVSS 9.1, published 19 Aug 2026) - [CVE-2026-48162: Wazuh path traversal in cluster DAPI send_tmp_file](https://junglewise.ai/threats/cve-2026-48162-wazuh-path-traversal-in-cluster-dapi-send-tmp-file) (critical, CVSS 9.1, published 19 Aug 2026) - [CVE-2026-30893: Wazuh is a free and open source platform used for threat prevention, detection, and response. From version 4.4.0 to…](https://junglewise.ai/threats/cve-2026-30893-wazuh-is-a-free-and-open-source-platform-used-for-threat) (critical, CVSS 9, published 29 Apr 2026) - [CVE-2026-44252: Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.0.0 until 4.14.5…](https://junglewise.ai/threats/cve-2026-44252-wazuh-is-a-free-and-open-source-platform-used-for-threat) (high, CVSS 8.8, published 19 Aug 2026) - [CVE-2026-44901: Wazuh remote code execution in cluster merge](https://junglewise.ai/threats/cve-2026-44901-wazuh-remote-code-execution-in-cluster-merge) (high, CVSS 8.4, published 19 Aug 2026) - [CVE-2026-28220: Wazuh Cluster unsafe deserialization and RBAC bypass in DAPI](https://junglewise.ai/threats/cve-2026-28220-wazuh-cluster-unsafe-deserialization-and-rbac-bypass-in-dapi) (high, CVSS 8.4, published 20 Jul 2026) - [CVE-2026-41424: Wazuh authentication bypass in user password update](https://junglewise.ai/threats/cve-2026-41424-wazuh-authentication-bypass-in-user-password-update) (high, CVSS 8.2, published 19 Aug 2026) - [CVE-2025-62786: Wazuh is a free and open source platform used for threat prevention, detection, and response. A heap-based…](https://junglewise.ai/threats/cve-2025-62786-wazuh-is-a-free-and-open-source-platform-used-for-threat) (high, CVSS 8.1, published 29 Oct 2025) ## Vulnerabilities per week 1 vulnerability in the last four weeks, down 50% on the four before (2). | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 16 | 3 | 0 | | 24 Aug 2026 | 6 | 1 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 2 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 1 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other Wazuh technologies - [Wazuh Manager](https://junglewise.ai/threats/technologies/wazuh-manager): 31 vulnerabilities - [Wazuh Agent](https://junglewise.ai/threats/technologies/wazuh-agent): 8 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Wazuh vulnerabilities", https://junglewise.ai/threats/technologies/wazuh, 12 November 2026.