PT-2026-35965 · Wazuh · Wazuh

Alimezar · Published 2026-04-29 · Updated 2026-04-29 · CVE-2026-26206

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Wazuh versions 4.0.0 through 4.14.3

Description Wazuh server API brute-force protection for the 'POST /security/user/authenticate' endpoint can be bypassed by sending concurrent authentication requests. While the max login attempts threshold is correctly enforced for sequential requests, a parallel burst allows more failed login attempts to be processed before an IP block is applied, enabling more password guesses than the configured policy intends.

Recommendations Update to version 4.14.4.

Exploit

Fix

Time Of Check To Time Of Use

Improper Restriction of Excessive Authentication Attempts

Race Condition

Weakness Enumeration

CWE-367

CWE-307

CWE-362

Related Identifiers

CVE-2026-26206

Affected Products

Wazuh

References · 4

• 🔥 https://github.com/wazuh/wazuh/security/advisories/GHSA-m2mr-xhhv-jx58 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-26206 · Security Note
• https://github.com/wazuh/wazuh/releases/tag/v4.14.4 · Note
• https://twitter.com/CVEnew/status/2049578381126316214 · Twitter Post