CVE-2026-54084

Wazuh agents in versions 4.0.0 through 4.14.6 can be crashed during enrollment when a malicious or man-in-the-middle manager returns a malformed key response containing fewer than the expected four space-separated fields. The w_enrollment_process_agent_key() routine does not validate that all fields exist before passing them to OS_IsValidName(), which calls strlen() on a NULL argument, causing a deterministic denial of service against the agent process. The attack is feasible when agents enroll without a CA certificate configured to verify the manager, allowing a rogue manager or network-level attacker to repeatedly kill agents. Affected parties are organizations running Wazuh agents in the vulnerable range with unverified enrollment channels; confidentiality and integrity are not impacted. Exploitation status is limited to a public technical advisory with a reproducible trigger (no observed in-the-wild abuse, EPSS 0.1%, not in CISA KEV), and the issue is fixed in version 4.14.7.

What to do: Upgrade all Wazuh agents and managers to version 4.14.7 or later, which adds validation of the enrollment key fields. As a hardening measure, configure agent enrollment to verify the manager via CA certificate so agents cannot be pointed at a rogue or spoofed manager. Additionally, restrict enrollment/service ports (e.g., TCP 1514) to trusted networks and monitor for unexpected agent process crashes or repeated re-enrollment attempts.