CVE-2026-33434
Wazuh 4.6.0 – 4.14.5
Raw vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:LSummary
CVE-2026-33434 is a medium-severity Improper Control of Interaction Frequency (CWE-799) vulnerability in Wazuh Wazuh. Its CVSS base score is 4.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Brute Force (T1110); ranked at the 18th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to AC-10 (Concurrent Session Control) and AC-7 (Unsuccessful Logon Attempts) — see the control section below for these in your framework.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-45076
Vulnerability Data
Wazuh is a free and open source platform used for threat prevention, detection, and response. In versions 4.6.0 and above, prior to 4.14.5, a logic error in CheckRateLimitsMiddleware.dispatch() causes the /events endpoint rate check to unconditionally overwrite the general rate…
more
limit result. When the global max_request_per_minute is exceeded, requests to /events still succeed if the events-specific counter (hardcoded 30/min) has not been reached. This allows event injection into analysisd beyond the admin-configured global rate limit. This issue has been fixed in version 4.14.5.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
ac-10 enforces a hard limit on concurrent sessions per user, directly stopping uncontrolled interaction frequency at the session level.
ac-7 directly enforces a limit on the frequency of invalid authentication attempts, structurally preventing the weakness for that interaction class.
sc-5 reduces the impact of excessive request volume (DoS) but does not itself impose the frequency controls whose absence defines the weakness.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Protecting networks from unauthorized usage can incorporate rate limiting to bound interaction frequency.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Network security controls can enforce rate limiting and throttling at the perimeter.
Application security requirements explicitly include controls on interaction frequency and throttling.
Secure architecture principles recommend rate-limiting and resource-management mechanisms.
Secure coding practices can embed input-frequency and throttling checks in code.
Capacity management directly limits request rates and resource exhaustion that CWE-799 describes.