CVE-2026-32983 | Wazuh up to 4.7.3/4.7.x authd default permission (EUVD-2026-16686)

VDB-353950 · CVE-2026-32983 · EUVD-2026-16686 WAZUH UP TO 4.7.3/4.7.X AUTHD DEFAULT PERMISSION HISTORYDIFFRELATEJSONXMLCTI CVSS Meta Temp Score Current Exploit Price (≈) CTI Interest Score 5.4 $0-$5k 1.78 Summaryinfo A vulnerability, which was classified as critical, was found in Wazuh up to 4.7.3/4.7.x. This vulnerability affects unknown code of the component authd. Executing a manipulation can lead to default permission. This vulnerability is registered as CVE-2026-32983. It is possible to launch the attack remotely. No exploit is available. You should upgrade the affected component. Detailsinfo A vulnerability was found in Wazuh up to 4.7.3/4.7.x. It has been declared as critical. This vulnerability affects some unknown functionality of the component authd. The manipulation with an unknown input leads to a default permission vulnerability. The CWE definition for the vulnerability is CWE-276. During installation, installed file permissions are set to allow anyone to modify those files. As an impact it is known to affect availability. CVE summarizes: Wazuh Manager authd service in wazuh-manager packages through version 4.7.3 contains an improper restriction of client-initiated SSL/TLS renegotiation vulnerability that allows remote attackers to cause a denial of service by sending excessive renegotiation requests. Attackers can exploit the lack of renegotiation limits to consume CPU resources and render the authd service unavailable. The advisory is available at github.com. This vulnerability was named CVE-2026-32983 since 03/17/2026. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. The technical details are unknown and an exploit is not available. This vulnerability is assigned to T1222 by the MITRE ATT&CK project. Upgrading to version 4.8.0 eliminates this vulnerability. The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-16686). Productinfo Name Wazuh Version 4.0 4.1 4.2 4.3 4.4 4.5 4.6 4.7 4.7.0 4.7.1 4.7.2 4.7.3 CPE 2.3info 🔒 🔒 🔒 CPE 2.2info 🔒 🔒 🔒 CVSSv4info VulDB Vector: 🔒 VulDB Reliability: 🔍 CNA CVSS-B Score: 🔒 CNA CVSS-BT Score: 🔒 CNA Vector: 🔒 CVSSv3info VulDB Meta Base Score: 5.5 VulDB Meta Temp Score: 5.4 VulDB Base Score: 5.3 VulDB Temp Score: 5.1 VulDB Vector: 🔒 VulDB Reliability: 🔍 CNA Base Score: 5.8 CNA Vector (VulnCheck): 🔒 CVSSv2info Vector Complexity Authentication Confidentiality Integrity Availability Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock VulDB Base Score: 🔒 VulDB Temp Score: 🔒 VulDB Reliability: 🔍 Exploitinginfo Class: Default permission CWE: CWE-276 / CWE-266 CAPEC: 🔒 ATT&CK: 🔒 Physical: No Local: No Remote: Yes Availability: 🔒 Status: Not defined Price Prediction: 🔍 Current Price Estimation: 🔒 0-Day Unlock Unlock Unlock Unlock Today Unlock Unlock Unlock Unlock Threat Intelligenceinfo Interest: 🔍 Active Actors: 🔍 Active APT Groups: 🔍 Countermeasuresinfo Recommended: Upgrade Status: 🔍 0-Day Time: 🔒 Upgrade: Wazuh 4.8.0 Timelineinfo 03/17/2026 CVE reserved 03/27/2026 +10 days Advisory disclosed 03/27/2026 +0 days VulDB entry created 03/27/2026 +0 days VulDB entry last update Sourcesinfo Advisory: github.com Status: Confirmed CVE: CVE-2026-32983 (🔒) GCVE (CVE): GCVE-0-2026-32983 GCVE (VulDB): GCVE-100-353950 EUVD: 🔒 Entryinfo Created: 03/27/2026 16:59 Updated: 03/27/2026 18:17 Changes: 03/27/2026 16:59 (75), 03/27/2026 18:17 (1) Complete: 🔍 Cache ID: 99:BB6:101 Discussion No comments yet. Languages: en. Please log in to comment. ◂ PreviousOverviewNext ▸