CVE-2026-74035

Name of the Vulnerable Software and Affected Versions Wazuh versions 4.6.0 through 4.14.7

Description An authentication bypass exists because the security.update user function implements the reserved user guard and password policy within a falsy truthiness check. This allows a delegated user administrator to send an empty password to the user update endpoint, bypassing the reserved user guard to take over the superuser account and authenticate using empty credentials.

Recommendations Update Wazuh to version 4.14.8 or later.