CVE-2026-74035

CVSS 8.6 (high) · published 2026-10-13

Wazuh versions from 4.6.0 before 4.14.8 contain an authentication bypass vulnerability where security.update_user places the reserved user guard and password policy inside a falsy truthiness check. A delegated user administrator can send an empty password to the user update endpoint, bypassing the reserved user guard to take over the wazuh superuser account and authenticate with empty credentials.

Weakness: CWE-863

Source: NVD CVE-2026-74035

References

• https://github.com/wazuh/wazuh/releases/tag/v4.14.8
• https://github.com/wazuh/wazuh/security/advisories/GHSA-27gv-q7q6-f5qh
• https://www.vulncheck.com/advisories/wazuh-4.6.0-before-4.14.8-authentication-bypass-via-empty-password-in-update-user

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.