CVE Feed

    Dashboard / CVE / CVE-2026-74039

    CVE-2026-74039

    Wazuh 4.0.0 before 4.14.7 and 5.0.0-beta2 contain a denial of service vulnerability that allows authenticated attackers with allow_run_as enabled to exhaust CPU resources by submitting arbitrarily deeply nested JSON structures to the POST /security/user/authenticate/run_as endpoint. Attackers can repeatedly submit malformed auth_context bodies with unlimited nesting depth to cause the API framework to consume excessive CPU, denying service to all other API consumers.

    Published:Aug 18, 2026
    Last Modified:Aug 21, 2026
    EPS:Aug 18, 2026
    EPSS Score:0.00295
    CVSS Score:6.5

    Affected Products

    Vendor
    Wazuh
    Product
    Wazuh-manager

    Exploits

    No exploit reference

    Related CVEs

    CVE-2026-74046 (CVSS 6.9) — Wazuh 4.4.0 before 4.14.7 contains a denial of service vulnerability in the fdecompress_files() function withi…
    CVE-2026-74044 (CVSS 7) — Wazuh 4.0.0 before 4.14.6 contains a path traversal vulnerability that allows authenticated cluster peers to d…
    CVE-2026-74038 (CVSS 7) — Wazuh 4.0.0 before 4.14.6 contains a path traversal vulnerability that allows unauthenticated remote attackers…
    CVE-2025-15616 (CVSS 7.1) — Wazuh wazuh-agent and wazuh-manager versions 2.1.0 before 4.8.0 contain multiple shell injection and untrusted…
    CVE-2025-15615 (CVSS 6.9) — Wazuh Manager authd service in wazuh-manager packages through version 4.7.3 contains an improper restriction o…
    CVE-2026-32983 (CVSS 6.9) — Wazuh Manager authd service in wazuh-manager packages through version 4.7.3 contains an improper restriction o…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High