CVE Feed

    Dashboard / CVE / CVE-2026-74046

    CVE-2026-74046

    Wazuh 4.4.0 before 4.14.7 contains a denial of service vulnerability in the fdecompress_files() function within cluster.py that allows authenticated cluster peers to exhaust memory by supplying a malicious synchronization archive without decompressed size limits. Attackers holding a valid cluster Fernet key can upload a small, highly compressed zip bomb archive that forces wazuh-clusterd on the master node to decompress the full payload into memory, causing memory exhaustion and service disruption.

    Published:Aug 18, 2026
    Last Modified:Aug 21, 2026
    EPS:Aug 18, 2026
    EPSS Score:0.00316
    CVSS Score:4.9

    Affected Products

    Vendor
    Wazuh
    Product
    Wazuh-manager

    Exploits

    No exploit reference

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2026-74044 (CVSS 7) — Wazuh 4.0.0 before 4.14.6 contains a path traversal vulnerability that allows authenticated cluster peers to d…
    CVE-2026-74039 (CVSS 7.1) — Wazuh 4.0.0 before 4.14.7 and 5.0.0-beta2 contain a denial of service vulnerability that allows authenticated …
    CVE-2026-74038 (CVSS 7) — Wazuh 4.0.0 before 4.14.6 contains a path traversal vulnerability that allows unauthenticated remote attackers…
    CVE-2025-15616 (CVSS 7.1) — Wazuh wazuh-agent and wazuh-manager versions 2.1.0 before 4.8.0 contain multiple shell injection and untrusted…
    CVE-2025-15615 (CVSS 6.9) — Wazuh Manager authd service in wazuh-manager packages through version 4.7.3 contains an improper restriction o…
    CVE-2026-32983 (CVSS 6.9) — Wazuh Manager authd service in wazuh-manager packages through version 4.7.3 contains an improper restriction o…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High