CVE-2026-93346

5.3Medium

Published 13 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash

5.3Medium

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None
Impact: Limited impact
Weakness: CWE-307

Impact

Unauthenticated attackers can bypass brute-force protections to perform unlimited password guessing against Wazuh API endpoints. They only need network access to send concurrent login requests to the API.

Root cause

A race condition in API login throttling verifies the block status before incrementing the failure count, allowing simultaneous requests to slip past max_login_attempts.

Affected systems

Wazuh 4.0.0 before 4.14.8

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Fix & remediation

Upgrade Wazuh manager and API to version 4.14.8 or later. If patching immediately is not possible, restrict network access to the Wazuh API port (default 55000) or place it behind an external rate-limiting proxy.

shell

$ sudo apt-get update && sudo apt-get install --only-upgrade wazuh-manager

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Wazuh from 4.0.0 before 4.14.8 contains a race condition in API login throttling that allows unauthenticated attackers to bypass max_login_attempts by sending concurrent requests. Attackers can fire concurrent login bursts to the authenticate and run_as endpoints, each passing the block check before failures are counted, enabling unlimited password guessing.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-93346