CVE-2026-26204: Heap Out-of-Bounds in Wazuh
Plattform
linux
Komponente
wazuh
Behoben in
4.14.4
CVE-2026-26204 is a security vulnerability affecting Wazuh, a popular open-source security platform. The vulnerability is a heap-based out-of-bounds write that occurs in the GetAlertData function. This flaw can be exploited by a malicious actor through a compromised Wazuh agent, potentially leading to denial of service or heap corruption. The vulnerability affects versions 1.0.0 through 4.14.3, and has been addressed in version 4.14.4.
Auswirkungen und Angriffsszenarien
The primary impact of CVE-2026-26204 is denial of service (DoS). A compromised Wazuh agent can trigger the out-of-bounds write, leading to heap corruption and potentially crashing the Wazuh manager. While the vulnerability does not directly lead to arbitrary code execution, heap corruption can have unpredictable consequences and could potentially be leveraged for more severe exploits in the future. The blast radius is limited to the Wazuh manager instance, but a successful DoS attack could disrupt security monitoring and incident response capabilities. The vulnerability highlights the importance of securing Wazuh agents and preventing them from being compromised.
Ausnutzungskontext
CVE-2026-26204 was published on 2026-04-29. Currently, there are no known public exploits or active campaigns targeting this vulnerability. The CVSS score of 4.4 (MEDIUM) indicates a moderate risk. It is not listed on KEV or EPSS as of this writing, suggesting a low probability of exploitation in the near term. Refer to the Wazuh security advisories and the NVD for updates and further information.
Bedrohungsanalyse
Exploit-Status
EPSS
0.02% (4% Perzentil)
CVSS-Vektor
Was bedeuten diese Metriken?
- Attack Vector
- Lokal — Angreifer benötigt eine lokale Sitzung oder Shell auf dem System.
- Attack Complexity
- Niedrig — keine besonderen Bedingungen erforderlich. Zuverlässig ausnutzbar.
- Privileges Required
- Hoch — Administrator- oder Privilegienkonto erforderlich.
- User Interaction
- Keine — automatischer und lautloser Angriff. Das Opfer tut nichts.
- Scope
- Unverändert — Auswirkung auf das anfällige Komponente beschränkt.
- Confidentiality
- Keine — kein Vertraulichkeitseinfluss.
- Integrity
- Keine — kein Integritätseinfluss.
- Availability
- Hoch — vollständiger Absturz oder Ressourcenerschöpfung. Totaler Denial of Service.
Betroffene Software
Schwachstellen-Klassifikation (CWE)
Zeitleiste
- Veröffentlicht
- Geändert
- EPSS aktualisiert
Mitigation und Workarounds
The recommended mitigation for CVE-2026-26204 is to upgrade Wazuh to version 4.14.4 or later. If an immediate upgrade is not possible, consider implementing temporary workarounds. Segment your network to limit the potential impact of a compromised agent. Implement strict access controls for Wazuh agents to prevent unauthorized modifications. Regularly scan your Wazuh agents for vulnerabilities and malware. Monitor Wazuh manager logs for unusual activity or crashes. While no specific WAF rules or Sigma/YARA patterns are readily available, consider developing custom rules to detect suspicious behavior related to alert data processing. After upgrading, confirm the fix by testing the GetAlertData function with crafted input to ensure the out-of-bounds write is prevented.
So behebenwird übersetzt…
Actualice a la versión 4.14.4 o superior para mitigar la vulnerabilidad. Esta actualización corrige un error de escritura fuera de límites en la memoria que podría permitir la corrupción de la memoria o la denegación de servicio.
Häufig gestellte Fragen
Was ist CVE-2026-26204 — Denial of Service (DoS) in Wazuh?
It's a heap-based out-of-bounds write vulnerability in Wazuh that can lead to denial of service.
Bin ich von CVE-2026-26204 in Wazuh betroffen?
If you're using Wazuh versions 1.0.0 through 4.14.3, you are potentially affected. Upgrade to 4.14.4 or later.
Wie behebe ich CVE-2026-26204 in Wazuh?
Upgrade Wazuh to version 4.14.4 or later. Consider network segmentation and access controls as temporary measures.
Wird CVE-2026-26204 aktiv ausgenutzt?
No known exploits or active campaigns have been reported, but the risk remains.
Wo finde ich den offiziellen Wazuh-Hinweis für CVE-2026-26204?
Check the Wazuh security advisories and the NVD entry for CVE-2026-26204.
Ist dein Projekt betroffen?
Lade deine Abhängigkeitsdatei hoch und erfahre sofort, ob dich diese und andere CVEs treffen.
Jetzt testen — kein Konto
Laden Sie ein Manifest hoch (composer.lock, package-lock.json, WordPress Plugin-Liste…) oder fügen Sie Ihre Komponentenliste ein. Sie erhalten sofort einen Schwachstellenbericht. Das Hochladen einer Datei ist nur der Anfang: Mit einem Konto erhalten Sie kontinuierliche Überwachung, Slack/email-Benachrichtigungen, Multi-Projekt- und White-Label-Berichte.
Abhängigkeitsdatei hier ablegen
composer.lock, package-lock.json, requirements.txt, Gemfile.lock, pubspec.lock, Dockerfile...