Wazuh is a free and open source platform used for threat prevention, detection, and response
Why It Matters
Analysis dossierWhy It Matters
Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.6.0 until 4.14.6 and 5.0.0-beta3, DB::getFile() and DB::searchFile() in src/syscheckd/src/db/src/file.cpp concatenate a monitored file path into SQLite row filters. On non-Windows systems, FIMDBCreator::encodeString() does not escape the value. A local user who can create a filename in a File Integrity Monitoring directory can inject a UNION SELECT expression when wazuh-syscheckd processes or deletes that path. The confirmed primitive manipulates SELECT result sets consumed by the FIM code; stacked statements and remote code execution were not demonstrated. This issue is fixed in versions 4.14.6 and 5.0.0-beta3.
Medium
Unknown
Unknown
Risk basis: Microsoft or Microsoft-managed product relevance; Source severity; no confirmed exploitation signal
Affected Products & Remediation
1 source-backed product- wazuh wazuh · >= 4.6.0 < 4.14.6; 5.0.0 · NVD CPE · Source
Vendor or catalog guidance (source)
Not provided by source
Known exploitation (source facts)
Only what a source states. Unknown means no source has said either way; it is not "not exploited".
- CISA KEV
- Unknown
- Exploited (source statement)
- Unknown
- Publicly disclosed (source)
- Unknown
Suggested hunting (rule-based inference)
SecOps Signal recommendation (rule-based inference). These steps are hunting hypotheses from the vulnerability class; they do not state or imply that exploitation occurred here or anywhere.
Matched sql-injection (CWE-89); local-access-review (CVSS AV:L, CVSS PR:L)
Exposure
- Locate the affected application endpoint and confirm its deployed version.Telemetry: Application access logs · The CWE describes a weakness class, not which local endpoint is affected. · Rule sql-injection
- Identify hosts reporting this CVE, prioritising shared or multi-user systems.Telemetry: DeviceTvmSoftwareVulnerabilities · A local, low-privilege vector matters most where untrusted users can run code. · Rule local-access-review
Exploitation evidence
- Review requests to the affected endpoint for unusual query syntax and response anomalies.Telemetry: Application access logs · Request and error patterns can guide an SQL injection investigation. · Rule sql-injection
Show more (2)
Exploitation evidence
- Review source-stated impact and relevant application errors on affected hosts; local access alone does not establish privilege escalation.Telemetry: DeviceProcessEvents · The vector establishes local access and low privileges only. Confirm the impact from the advisory before choosing a specific hunt. · Rule local-access-review
Response
- Verify the source-stated fix and test the affected endpoint after deployment.Telemetry: Application change records · The exact application fix must be confirmed locally. · Rule sql-injection
CISA KEV Record
CISA KEV status was not determined for this record.
Change History & Source Data
— No recorded material change
- CNA / source
- security-advisories@github.com
- Record status · verification
- UPDATED · NVD API
- CPE
- cpe:2.3:a:wazuh:wazuh:*:*:*:*:*:*:*:*, cpe:2.3:a:wazuh:wazuh:5.0.0:beta1:*:*:*:*:*:*, cpe:2.3:a:wazuh:wazuh:5.0.0:beta2:*:*:*:*:*:*
Evidence & Provenance
Linked by the query's stored exact CVE association. Review required tables and validation status before use.
DeviceTvmSoftwareVulnerabilities| where CveId == "CVE-2026-49392"| project DeviceId, DeviceName, OSPlatform, OSVersion, SoftwareVendor, SoftwareName, SoftwareVersion, CveId, VulnerabilitySeverityLevel, RecommendedSecurityUpdate, RecommendedSecurityUpdateId| sort by VulnerabilitySeverityLevel descLooking up related community queries…