Wazuh vulnerabilities

1 CVE tracked

Wazuh appears in our reports within the context of community-driven detection content (open-sourced Sigma rules and compiler) and AI-enhanced SOC workflow integration. A critical vulnerability, CVE-2026-67307, affects Wazuh 5.0.0-beta1, where insufficient validation of 'cluster_name' and 'cluster_node' fields in inventory-sync messages allows a low-privileged agent to spoof cluster attributes. Defenders should immediately upgrade Wazuh managers to version 5.0.0-beta3 and carefully assess the use of beta releases in production environments.

This hub is built from skopnix's own reporting on Wazuh: the overview is AI-written from that coverage and every CVE links to its grounded explainer. KEV status comes from CISA's Known Exploited Vulnerabilities catalog and EPSS from FIRST — vendor, version and score details are never invented.