Wazuh Manager: Authentication bypass via empty password in update_user
Summary
Wazuh Manager versions 4.6.0 up to 4.14.7 contain an authentication bypass in the update_user API function. An empty password skips the password checks and the protection of reserved accounts, so a delegated user administrator can set an empty password for the built-in wazuh superuser and log in with empty credentials. The attacker needs an existing account with user administration rights, and the flaw is reachable over the network.
Affected
- Wazuh Manager (wazuh-manager) 4.6.0 up to before 4.14.8
Fixed in
- Upgrade to Wazuh 4.14.8 or later
Workaround
- No vendor workaround published. Upgrading is the remedy.
Exploitation
- Not listed in CISA KEV. No confirmed exploitation in the wild in the sources.
- CISA SSVC: exploitation none, not automatable, total technical impact.
- The GHSA advisory reportedly contains proof-of-concept code (not verified).
Our recommendation
- Upgrade wazuh-manager to 4.14.8 or later.
- Until then, review who holds user administration rights and remove unnecessary ones.
- Check the wazuh superuser account and recent password changes via the API for unexpected activity.
- Do not expose the Wazuh API to the internet.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Wazuh release v4.14.8 github.com
- GitHub Security Advisory GHSA-27gv-q7q6-f5qh github.com
- VulnCheck advisory www.vulncheck.com
- Fix pull request #38180 github.com
- OSV entry CVE-2026-74035 osv.dev
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 08:31.
Original description (NVD)
Wazuh versions from 4.6.0 before 4.14.8 contain an authentication bypass vulnerability where security.update_user places the reserved user guard and password policy inside a falsy truthiness check. A delegated user administrator can send an empty password to the user update endpoint, bypassing the reserved user guard to take over the wazuh superuser account and authenticate with empty credentials.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.