Is CVE-2026-74035 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-74035?

CVE-2026-74035 has a CVSS v3 severity of HIGH (7.2).

Back

CVE-2026-74035

Description

Wazuh versions from 4.6.0 before 4.14.8 contain an authentication bypass vulnerability where security.update_user places the reserved user guard and password policy inside a falsy truthiness check. A delegated user administrator can send an empty password to the user update endpoint, bypassing the reserved user guard to take over the wazuh superuser account and authenticate with empty credentials.