Ing. Calogero Bono
On November 9, 2026, Italy's National Cybersecurity Agency published an alert on Wazuh, the open source SIEM. Proof of Concept exploits are available for 8 vulnerabilities, 5 of them rated high severity, affecting Wazuh and its Dashboard Plugins. The vendor has already fixed the flaws, but public demonstration exploits lower the bar for anyone who wants to try them. If you use Wazuh to monitor the security of your infrastructure, check the installed version now.
A few terms before we get into the facts. SIEM is a system that collects and analyzes logs to surface attacks. XDR extends monitoring across more layers, from devices to the network. A PoC (Proof of Concept) is demonstration code that shows a flaw can be exploited. The CVSS is the 0 to 10 score that measures severity. SSRF is an attack that tricks a server into sending requests to an address chosen by the attacker.
What did the ACN report about Wazuh?
The alert AL02/261109/CSIRT-ITA covers 8 vulnerabilities with publicly released PoCs. The listed types are arbitrary code execution, authentication bypass, security restriction bypass, information disclosure, denial of service and spoofing.
In the agency's table every flaw is marked as having a PoC present, while there is no indication of active exploitation. The alert is at version 1.0.
Which Wazuh versions are vulnerable?
According to the ACN, Wazuh versions prior to 4.14.9 are affected, as are the Wazuh Dashboard Plugins from 4.9.0 up to but not including 4.14.9. The recommended mitigation is to update promptly to the latest available version.
The vendor, the agency explains, has already patched the flaws. The risk therefore weighs mainly on those who have not yet applied the update.
What are the most serious flaws?
At the top is CVE-2026-112340, with a CVSS v4.0 score of 8.8. It affects the /api/request endpoint of the Dashboard plugins. An authenticated user could overwrite the Bearer token and act as another identity on the Manager API.
Next come CVE-2026-112339 (8.2), caused by the missing TLS hostname verification in the fluent-forward module, and CVE-2026-112338 (8.2), an SSRF in the GitHub module. In the first case an on-path attacker could impersonate the Fluentd collector and read telemetry. In the second, the Manager could send the GitHub token to an attacker-controlled host.
The remaining high-severity entries are CVE-2026-112341 and CVE-2026-112336, both at 7.1.
What risks do the other vulnerabilities pose?
CVE-2026-112341 is a SQL Injection. A user with agent – read permission on at least one agent could run arbitrary queries and read Manager database data, including the agents' internal_key values. CVE-2026-112336 is a memory leak in the JSON decoder. Events with duplicated static fields, sent by a registered agent, could crash wazuh-analysisd and stop alert generation.
The other three score between 6.3 and 6.9.
- CVE-2026-112334, an out-of-bounds write in wazuh-execd, leading to Active Response being halted.
- CVE-2026-112335, a stack buffer overflow in logcollector, with possible code execution under specific configurations.
- CVE-2026-112337, an SSRF in the Azure module, putting the Microsoft Graph token at risk.
Limits to know
The alert does not report active exploitation, and the dedicated column remains empty. We do not know how many Italian systems are exposed or how long the PoCs have been circulating. Many attacks require specific conditions, such as an authenticated user, control over a monitored log file, or a privileged network position. Some CVE identifiers may still be updated in the official databases.
What changes for those working in digital
If you run Wazuh, check the version of the Manager and Dashboard Plugins right away. Even if your service runs on a hosted server, you need to know who handles updates, and a server management service with security updates is built for exactly that. The risk also extends to linked tokens, such as those for GitHub and Azure, which should be treated as credentials to protect. This is not the first recent report on technical tools, as the case of Apache OFBiz shows.
Our take
It is striking that the target is a tool built to defend. A SIEM sees logs, credentials and telemetry from across the infrastructure, so a flaw in it matters more than one in an ordinary application. The vendor has fixed the issues and the ACN has issued a clear warning, but open source does not excuse you from updating. Anyone adopting it in a company should plan for the maintenance, as the guide on open source in business points out.
Frequently asked questions
Is Wazuh under active attack?
The ACN alert does not say so. The exploitation column shows a dash for all CVEs, while the PoCs are confirmed as present.
Which Wazuh version should I install?
At least 4.14.9. Earlier Wazuh versions are vulnerable, as are the Dashboard Plugins from 4.9.0 up to but not including 4.14.9.
How many vulnerabilities are there and how severe are they?
There are 8, 5 of them high severity. The highest CVSS v4.0 score is 8.8, the lowest is 6.3.
Do attackers need to be authenticated to exploit them?
It depends on the flaw. Some require an authenticated user or a registered agent, others an attacker in a privileged network position or with access to monitored files.
What is at risk for the GitHub and Azure tokens?
Two SSRF flaws could cause the Manager to send tokens to attacker-controlled hosts. According to the ACN, this could grant access to linked GitHub repositories or Microsoft Graph resources.
What to watch after updating Wazuh
Updating closes the known flaws, but the public PoCs remain available and can be adapted. In the coming weeks it is worth checking what has happened in the meantime.
- Check the Manager logs for unusual requests to external hosts or unexpected restarts of wazuh-analysisd.
- Check whether the ACN updates the alert with indications of active exploitation.
- Consider rotating the GitHub and Azure tokens linked to Wazuh modules if the systems were left unpatched.
