CVE-2026-32984: 
Wazuh Agent vulnerability analysis and mitigation

CVE-2026-32984 is a heap-buffer overflow vulnerability in Wazuh's authentication daemon (authd) that allows attackers to cause memory corruption and malformed heap data by sending specially crafted input. The vulnerability affects Wazuh versions up to and including 3.5.0, as well as version 4.3.10. It was published on March 27, 2026, and assigned by VulnCheck. The CVSS v3.1 base score is 3.5 (Low), while the CVSS v4.0 base score is 5.3 (Medium) (Red Hat CVE, ENISA EUVD).

The root cause is classified as CWE-125 (Out-of-bounds Read), manifesting as a heap-buffer overflow in the Wazuh authd component. An attacker can send specially crafted network input to the authentication daemon, triggering memory corruption and malformed heap data. Exploitation requires low privileges and user interaction (CVSS v3.1), though the CVSS v4.0 vector indicates no privileges are required with passive user interaction. The attack vector is network-based with low attack complexity (Red Hat CVE, VulnCheck Advisory).

Successful exploitation results in a denial of service (DoS) condition affecting the Wazuh authentication daemon (authd), with low impact on availability and no impact on confidentiality or integrity. The scope is limited to the authd process itself, meaning an attacker could disrupt agent authentication workflows but is unlikely to achieve code execution or data exfiltration based on current analysis. Lateral movement potential is minimal given the constrained impact scope (Red Hat CVE, ENISA EUVD).

Users should review the affected versions (Wazuh ≤ 3.5.0 and 4.3.10) and upgrade to a patched release as recommended by the Wazuh project. Network-level controls such as restricting access to the authd port (default: 1515/TCP) to trusted agent IP ranges can reduce exposure. Monitor the GitHub Security Advisory and VulnCheck advisory for patch availability and additional guidance (VulnCheck Advisory, GitHub Advisory).