Wazuh details eight flaws three weeks after shipping the 4.14.9 fix

Wazuh details eight flaws three weeks after shipping the 4.14.9 fix

6 November 2026: Wazuh has published eight security advisories for its open source security monitoring platform, two rated high, and says the fix is version 4.14.9, which has been available since 15 October. Anyone who held off on that release because it looked routine now has a reason to install it, starting with a flaw that lets a host with an enrolled agent identity stop the manager's analysis engine.

Not yet independently verified. We opened three of the eight advisory pages in full, and those name 4.14.9 as the fix; the other five are described from the advisory list. The pages we read show GHSA numbers rather than CVE numbers. We will update this when it can be confirmed, and remove this note.

The two high-severity advisories

GHSA-6w6h-fwqm-6hjj affects the manager from 3.0.0 through 4.14.7. Repeated static JSON fields exhaust memory and terminate wazuh-analysisd, the process that evaluates events. It can be reached by any host with an enrolled agent identity, and in the default Docker setup enrolment on TCP port 1515 needs no password, with events then sent on port 1514.

That combination is what makes it awkward. A monitoring tool that an attacker can silence is a gap in detection at the moment it matters most, and the attacker needs little more than network reach to the enrolment port on a default install.

GHSA-7rvv-9467-96mc is in the dashboard plugin. Its /api/request route lets an authenticated user override the Authorization header sent to the Manager API, which affects versions from 4.9.0. In a shared deployment, that could carry a lower-privilege dashboard user past their role.

Six more, and a Windows agent issue

• GHSA-3gq8-gg8f-5h8h (moderate): a stack overflow in read_snortfull() in the Windows agent, causing a crash and offering a code execution primitive at SYSTEM level
• GHSA-qj88-7rr2-4chx (moderate): SQL injection placeholder cross-contamination that can leak agent secrets
• GHSA-v8ww-qhjh-j6w9 (moderate): the fluent-forward feature lacks TLS hostname verification
• GHSA-jmq7-vgh3-wq9v (moderate): server-side request forgery through a GitHub link
• GHSA-f4pj-j296-jwp2 (moderate): an out-of-bounds write in execd
• GHSA-qxg8-jrjm-w96h (low): server-side request forgery through the Azure Graph nextLink value

The Windows agent entry reaches furthest, because agents run on endpoints across an estate rather than on one server.

What to change besides the version

Upgrading the manager is the first step, but agents need attention too, since one of the flaws is in the Windows agent itself. Teams running the default Docker deployment should review whether passwordless enrolment is still needed and whether port 1515 is reachable from networks that do not need it.

Germany's CERT-Bund listed the Wazuh flaws as high severity on 6 November, so security teams can expect the question from auditors. The three-week gap between fix and disclosure works in customers' favour only if they took the release when it shipped. Our SIEM software category lists fifteen products.

Company profile on TrustList: Wazuh

Sources

• Wazuh security advisories on GitHub, published 6 November 2026, 6 November 2026
• Wazuh release v4.14.9, 15 October 2026, 15 October 2026