CVE-2026-54084: 
Wazuh Server vulnerability analysis and mitigation

CVE-2026-54084 is a NULL pointer dereference vulnerability in the Wazuh agent enrollment process that allows a malicious or man-in-the-middle enrollment manager to crash a Wazuh agent by returning a malformed key response. It affects Wazuh versions 4.0.0 through 4.14.6 (wazuh-agent package) and was published on August 28, 2026, with the fix released in version 4.14.7. The vulnerability carries a CVSS v3.1 base score of 5.3 (Medium) (Wazuh Advisory).

The root cause is a NULL pointer dereference (CWE-476) in src/shared/enrollment_op.c within the w_enrollment_process_agent_key() function. This routine calls OS_StrBreak() to split the manager-provided enrollment key into four space-separated fields, but does not verify that all four fields are present before passing them to validators. OS_StrBreak() leaves missing trailing entries as NULL pointers; while OS_IsValidID() safely handles a NULL argument, OS_IsValidName() immediately calls strlen() on its argument without a NULL check, causing a segmentation fault when passed NULL. Because C's && operator evaluates left-to-right, a response like OSSEC K:'1' — where the first field is a valid ID but subsequent fields are absent — passes the first check and reaches OS_IsValidName(NULL), deterministically crashing the agent process. Wazuh permits enrollment against an unverified manager when no CA certificate is configured, making rogue-manager and MITM scenarios realistic in default or misconfigured deployments (Wazuh Advisory).

Successful exploitation results in a denial of service: the Wazuh agent process crashes during enrollment, preventing the agent from completing registration and leaving the endpoint unmonitored by the Wazuh XDR/SIEM platform. There is no confidentiality or integrity impact — the vulnerability cannot be used for data exfiltration or code execution, only agent process termination. In environments relying on Wazuh for endpoint detection and response, repeated exploitation could blind security teams to ongoing threats on affected hosts (Wazuh Advisory).

A proof-of-concept exploit is publicly available via the Wazuh GitHub security advisory, which provides a concrete, reproducible payload (OSSEC K:'1') and an ASAN harness demonstrating the deterministic crash. There is no evidence of active in-the-wild exploitation at this time. The EPSS score is approximately 0.00114, reflecting low probability of near-term exploitation, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to either operate a rogue enrollment manager or perform a MITM attack on the enrollment flow, which is facilitated by the absence of CA certificate verification in default Wazuh deployments (Wazuh Advisory).

1. Reconnaissance: Identify Wazuh agent deployments (versions 4.0.0–4.14.6) that are configured to enroll without a CA certificate (ca_cert == NULL), which causes the agent to log Registering agent to unverified manager and proceed without manager authentication.
2. Position for attack: Either set up a rogue Wazuh manager on the network reachable by the target agent, or perform a network-level MITM/rerouting attack to intercept the agent's enrollment TCP connection to the legitimate manager.
3. Intercept enrollment initiation: Wait for or trigger the Wazuh agent to initiate an enrollment request to the (rogue or intercepted) manager endpoint.
4. Send malformed key response: Respond to the agent's enrollment request with a malformed key payload containing fewer than four space-separated fields, for example: OSSEC K:'1'. This provides a valid numeric first field (entrys[0] = "1") while leaving entrys[1], entrys[2], and entrys[3] as NULL.
5. Trigger NULL dereference: The agent's w_enrollment_process_agent_key() function passes entrys[1] (NULL) to OS_IsValidName(), which calls strlen(NULL), causing a segmentation fault and crashing the agent process.
6. Achieve denial of service: The agent process terminates, preventing successful enrollment and leaving the endpoint without Wazuh monitoring coverage. The crash is deterministic and can be repeated on each re-enrollment attempt (Wazuh Advisory).

• Logs: Wazuh agent logs containing Registering agent to unverified manager indicate enrollment without CA verification, a prerequisite for exploitation; unexpected agent process termination entries or absence of enrollment completion messages in ossec.log.
• Process: Sudden, repeated crashes of the wazuh-agentd process during enrollment phases, particularly when re-enrollment is attempted multiple times in quick succession.
• Network: Enrollment traffic (typically TCP port 1515) directed to an unexpected or unauthorized IP address (rogue manager); ARP spoofing or unusual routing changes on the network segment used for agent-to-manager enrollment communication.
• File System: Core dump files generated by the wazuh-agentd process in the Wazuh working directory (e.g., /var/ossec/) following a crash during enrollment (Wazuh Advisory).

Upgrade Wazuh agents to version 4.14.7 or later, which fixes the vulnerability by adding NULL checks for all four enrollment key fields before invoking validators in w_enrollment_process_agent_key() (Wazuh Fix Commit). As a configuration-based workaround, configure a CA certificate (ca_cert) for manager verification in the agent's ossec.conf to prevent enrollment against unverified or rogue managers, eliminating the MITM attack surface. Additionally, implement network segmentation and monitoring to restrict enrollment traffic (TCP port 1515) to authorized manager IP addresses only (Wazuh Advisory).

The vulnerability was reported by researcher kocaemre and remediated by Wazuh developer vikman90, who published the advisory and fix on August 18, 2026. The advisory was classified as Moderate severity by Wazuh, consistent with the CVSS 5.3 score. No significant broader media coverage or notable community commentary beyond standard vulnerability database aggregation has been observed (Wazuh Advisory).