CVE-2026-74035
Received Received - Intake

Authentication Bypass in Wazuh via Empty Password

Publication date: 2026-10-13

Last updated on: 2026-10-13

Assigner: VulnCheck

Description
Wazuh versions from 4.6.0 before 4.14.8 contain an authentication bypass vulnerability where security.update_user places the reserved user guard and password policy inside a falsy truthiness check. A delegated user administrator can send an empty password to the user update endpoint, bypassing the reserved user guard to take over the wazuh superuser account and authenticate with empty credentials.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-13
Last Modified
2026-10-13
Generated
2026-10-13
AI Q&A
2026-10-13
EPSS Evaluated
N/A
NVD
CVE-2026-74035
EUVD
EUVD-2026-98673

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Wazuh wazuh-manager 4.6.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an authentication bypass vulnerability in Wazuh versions 4.6.0 to 4.14.7. The flaw is in the security.update_user function where a delegated user administrator can send an empty password to bypass the reserved user guard. This allows taking over the Wazuh superuser account and authenticating with empty credentials.

Detection Guidance

To detect this vulnerability, check if your Wazuh version is between 4.6.0 and 4.14.7. Run: wazuh-control -v or check the version in the Wazuh web interface. Also, review logs for unauthorized user update attempts or empty password authentications.

Impact Analysis

An attacker with delegated user administrator privileges could exploit this to gain full control of the Wazuh superuser account. This enables unauthorized access to sensitive data, system manipulation, and potential lateral movement within the network.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. Organizations using affected Wazuh versions may face compliance violations, potential fines, and reputational damage due to compromised data integrity and access controls.

Mitigation Strategies

Immediately upgrade Wazuh to version 4.14.8 or later. If upgrading is not possible, restrict access to the user update endpoint and monitor for suspicious activity. Disable delegated user administrator roles until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-74035. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart