CVE-2026-112339highCWE-297

CVE-2026-112339: high-severity vulnerability in wazuh

Wazuh 3.9.0 before 4.14.9 Missing TLS Hostname Verification in fluent-forward Module

Published

Follow this CVE+ Monitor wazuh

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

18Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.2
Wazuh from 3.9.0 before 4.14.9 contains a missing TLS hostname verification vulnerability in the fluent-forward module's wm_fluent_ssl_ctx() that allows network attackers to impersonate the Fluentd collector by presenting any certificate chaining to the configured ca_file. Attackers who redirect the connection via DNS, ARP, or on-path positions can receive forwarded security telemetry and the shared_key_hexdigest for offline cracking.
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Affected products
wazuh · wazuh
Related CVEs — wazuh

In the same product, most dangerous first.

CVE-2025-24016CRITICALRemote code execution in Wazuh serverEPSS 93.8%KEVCVE-2023-50260HIGHWazuh's vulnerability in host_deny AR script allows arbitrary command executionEPSS 41.2%CVE-2026-25769CRITICALWazuh Cluster vulnerable to Remote Code Execution via Insecure DeserializationEPSS 9.1%CVE-2024-32038CRITICALWazuh Analysis Engine Event Decoder Heap-based Buffer Overflow Remote Code Execution VulnerabilityEPSS 1.0%CVE-2026-25770CRITICALWazuh has Privilege Escalation to Root via Cluster Protocol File WriteEPSS 1.0%CVE-2026-61800CRITICALWazuh cluster worker file sync allows arbitrary file write under /var/ossec (incomplete fix for CVE-2026-30893)EPSS 1.0%