CVE-2026-54084

Executive Summary

CVE-2026-54084 is a denial-of-service vulnerability in Wazuh agents affecting versions 4.0.0 through 4.14.6. A malicious or man-in-the-middle (MITM) enrollment manager can crash a Wazuh agent during the enrollment process by returning a malformed key response containing fewer than four space-separated fields, triggering a NULL pointer dereference in the w_enrollment_process_agent_key() routine. The vulnerability is exploitable without credentials when no CA certificate is configured for enrollment verification, allowing an attacker operating a rogue manager or intercepting the enrollment flow to deterministically crash agents. The issue is fixed in version 4.14.7. Given a CVSS score of 5.3 (High availability impact) and the absence of a publicly available patch as of this writing, organizations running affected Wazuh versions should treat this as a high-priority availability risk.

Technical Analysis

Vulnerability Mechanism

The vulnerability resides in the Wazuh agent's enrollment logic — specifically within the w_enrollment_process_agent_key() routine. This function processes the manager-provided key response during agent registration. The expected format of a valid key response is four space-separated fields (e.g., a utility type identifier, an agent name, an agent ID, and a key value). The routine splits the incoming string using OS_StrBreak(), which tokenizes the input on space delimiters.

The flaw is twofold:

1. Insufficient field-count validation: The code does not verify that all four expected fields are present in the response before passing them to subsequent validator functions. OS_StrBreak() leaves missing trailing entries as NULL pointers when the input string contains fewer fields than expected.

2. NULL pointer dereference: The OS_IsValidName() validator function calls strlen() on its argument without a NULL check. When a malformed key response such as OSSEC K:'1' is provided — which contains only two fields — the third and fourth expected fields are NULL, and OS_IsValidName(NULL) dereferences NULL, causing an immediate segmentation fault that terminates the agent process.

Attack Surface

The attack surface for this vulnerability is the Wazuh enrollment protocol itself. During enrollment, the agent contacts a manager to obtain a registration key. Critically, Wazuh permits enrollment against an unverified manager when no CA certificate is configured. This means:

• Rogue manager scenario: An attacker can stand up a fake Wazuh manager on the network and respond to enrollment requests with a malformed key.
• MITM scenario: An attacker positioned between a legitimate agent and manager (e.g., on the same broadcast domain, or via ARP/DNS spoofing) can intercept the enrollment exchange and substitute the legitimate response with a malformed one.

The only factor raising the attack complexity (AC:H in the CVSS vector) is the requirement that the attacker successfully position themselves or deceive the agent into initiating enrollment against them, and that the agent must be in the enrollment process — a state-dependent condition.

Code-Level Explanation (as described)

The NVD description references four specific components:

• w_enrollment_process_agent_key() — the routine that processes the manager's key response.
• OS_StrBreak() — the string tokenization function that splits the key into fields and leaves missing trailing entries as NULL.
• OS_IsValidName() — the validator that calls strlen() without a NULL check, causing the crash.
• The expected format is four space-separated fields; a two-field response like OSSEC K:'1' triggers the failure.

No additional function names or implementation details beyond these are available from the CVE description, and none should be inferred.

Affected Components

• Wazuh agent: versions 4.0.0 through 4.14.6
• Configuration state: vulnerable when enrollment is performed without a CA certificate (i.e., cannot verify the manager's identity)
• Protocol: Wazuh enrollment (TCP-based key exchange)

Exploitation Scenarios

No public PoC is available; this attack chain is inferred from the vulnerability class (CWE-476 NULL Pointer Dereference) and the NVD description.

Step 1 — Reconnaissance / Target Identification

An attacker identifies Wazuh agents in an enrollment state. This can occur through:

• Passive network observation: Identifying agents sending enrollment requests (typically to TCP port 1515, though the NVD description does not confirm the port; the protocol is the Wazuh enrollment exchange).
• Active scanning: Identifying systems running the Wazuh agent software via service fingerprinting.
• Environmental awareness: Understanding that freshly deployed or re-enrolled agents are common in environments undergoing provisioning, reimaging, or certificate rotation.

Step 2 — Triggering the Flaw

The attacker must position themselves to respond to or intercept the enrollment request:

• Rogue manager: Deploy a fake Wazuh manager, configure it to listen on the expected enrollment endpoint, and respond to any incoming enrollment requests with a crafted malformed key response containing fewer than four fields (e.g., OSSEC K:'1').
• MITM interception: Use ARP spoofing, DNS spoofing, or BGP hijacking to redirect the agent's enrollment traffic through the attacker's systems, then proxy and modify the manager's response to strip fields.

The attack succeeds only if the agent has no CA certificate configured for manager verification — a default-enough configuration in many deployments where enrollment is performed over a trusted network segment.

Step 3 — Payload / Execution Method

At the vulnerability-class level, the attacker sends a malformed enrollment response missing required trailing fields. The agent's w_enrollment_process_agent_key() routine tokenizes this response, producing NULL pointers for the missing fields, then passes those NULL pointers to OS_IsValidName(), which dereferences them in a strlen() call.

The crash is deterministic — the NULL dereference occurs immediately upon processing the malformed response, terminating the agent process with a segmentation fault. No heap grooming or memory corruption control is required; the failure is a straightforward unconditional NULL dereference.

Step 4 — Post-Exploitation Impact

The immediate impact is the termination of the Wazuh agent process. This produces:

• Loss of endpoint visibility: The agent no longer sends telemetry, security events, or vulnerability data to the Wazuh manager.
• Loss of active response capabilities: The agent cannot execute response actions (e.g., firewall rule changes, process kills) on the endpoint.
• Availability degradation: If agents are part of a larger monitoring deployment, the loss of many agents can blind the SOC, enabling further intrusive activity to go undetected.

The impact is denial-of-service focused; there is no indication of code execution, privilege escalation, or data theft resulting from this flaw.

Impact Assessment

Business Impact

This vulnerability enables an unauthenticated remote attacker to crash Wazuh agents, creating a blind spot in an organization's security telemetry. In a targeted campaign, an attacker could use this to disable endpoint monitoring before launching further attacks (e.g., ransomware deployment, lateral movement) that would otherwise generate alerts.

Key business consequences:

• Security operations degradation: Loss of real-time endpoints log collection and detection.
• Compliance risk: Many regulatory frameworks (PCI DSS, HIPAA, SOC 2) require continuous monitoring; gaps in coverage can constitute a compliance failure.
• Operational overhead: Manual re-enrollment of crashed agents and investigation of crash causes consumes SOC resources.
• Scalable denial of service: An attacker controlling a network position can crash all enrolling agents on that segment indefinitely by responding to each enrollment retry with a malformed key.

CVSS Subscore Analysis

• Availability Impact: High (A:H) — the primary impact is the deterministic termination of the agent process.
• Confidentiality/Integrity: None (C:N/I:N) — no data exposure or modification.
• Attack Complexity: High (AC:H) — requires the attacker to successfully intercept or impersonate the manager, and the target must be in an enrollment state with no CA verification.
• User Interaction: Required (UI:R) — the agent must be actively attempting enrollment (a user or automated process may initiate it).
• Blast radius: Limited to the individual agent being enrolled; however, in mass-deployment scenarios (e.g., provisioning a large fleet), the attack can be scaled to simultaneously crash many agents.

Detection Guidance

The following detection rules target the signature characteristics of this attack: malformed enrollment key responses (fewer than four fields, or containing OSSEC K: with an incomplete field set) and the resulting agent process crashes.

Sigma Rule

title: Wazuh Agent Crash via Malformed Enrollment Key Response
id: 3a5c2e14-9b13-41f8-a1d2-9c4e8b74f012
status: experimental
description: >
  Detects attempts to crash a Wazuh agent during enrollment by returning a
  malformed key response with fewer than four fields, triggering a NULL
  pointer dereference in w_enrollment_process_agent_key().
references:
  - CVE-2026-54084
author: Valters IT Security Research
date: 2026/05/15
logsource:
  product: wazuh
  service: agent
detection:
  selection_enrollment_auth:
    category: process_creation
    product: linux
  selection_malformed_key:
    EventID: 1
    CommandLine|contains:
      - "OSSEC K:'"
      - "OSSEC K:\""
    CommandLine|re: "OSSEC\\s+K:['\"]?[^\\s]{1,20}['\"]?$"
  selection_crash:
    status: stopped
    Description|contains: "segfault"
  condition: selection_enrollment_auth and selection_malformed_key
  timeframe: 5m
falsepositives:
  - Legitimate but malformed enrollment responses from misconfigured managers
level: high
tags:
  - attack.t1190
  - cve.2026.54084
  - cwe.476
  - denial-of-service

YARA Rule

rule CVE_2026_54084_Wazuh_Malformed_Enrollment_Key
{
    meta:
        author = "Valters IT Security Research"
        description = "Detects network traffic or logs containing the malformed Wazuh enrollment key pattern that triggers NULL pointer dereference (CVE-2026-54084)."
        cve = "CVE-2026-54084"
        date = "2026-05-15"
        severity = "high"

    strings:
        $key_prefix = "OSSEC K:"
        $quote_single = "'"
        $quote_double = "\""
        $space = " "

    condition:
        // Enrollment key response that has a prefix but lacks the full
        // four-field structure (detects short/single-quoted key values)
        $key_prefix and
        (($quote_single and not 3 of ($space)) or ($quote_double and not 3 of ($space))) and
        filesize < 1KB
}

Suricata IDS Rule

alert tcp any any -> any 1515 (msg:"CVE-2026-54084 Wazuh Agent Enrollment Malformed Key Response NULL Pointer Dereference DoS"; flow:to_server; content:"OSSEC"; content:"K:"; distance:0; content:"'"; distance:0; within:10; pcre:"/^OSSEC\s+K:['\"]{1}[^\s'\"]{1,20}['\"]{1}\s*$/";

 classtype:attempted-dos; sid:5408401; rev:1; reference:cve,2026-54084; reference:url,https://nvd.nist.gov/vuln/detail/CVE-2026-54084; metadata:created_at 2026_05_15, updated_at 2026_05_15;)

Elastic Detection

// Detect Wazuh agent enrollment requests paired with immediate process termination
sequence by host.name with maxspan=60s
  [process where event.action == "start" and process.name : "wazuh-agent*" and process.args : "*enrollment*"]
  [process where event.action == "end" and process.exit_code == 139 and process.name : "wazuh-agent*"]

Splunk SPL Query

index=wazuh sourcetype=wazuh_agent
| eval process_end_time=_time
| transaction host maxspan=60s startswith=(status="started" message="enrollment") endswith=(status="stopped" exit_code=139)
| rename message as enrollment_message
| where enrollment_message LIKE "%OSSEC K:%"
| stats count by host, enrollment_message

Wazuh OSSEC Rule

<group name="wazuh_agent_enrollment,">
  <!-- Rule 1: Detect crash after enrollment attempt (agent-side log) -->
  <rule id="685366" level="12">
    <if_sid>500</if_sid>
    <match>segfault|core dumped|signal 11</match>
    <description>Wazuh agent process terminated with segmentation fault (possible CVE-2026-54084 exploitation)</description>
    <group>wazuh_agent_denial_of_service,</group>
  </rule>

  <!-- Rule 2: Detect malformed enrollment key response in agent logs -->
  <rule id="685367" level="10">
    <if_sid>500</if_sid>
    <match>OSSEC K:</match>
    <regex>^.*OSSEC\s+K:\s*'\S+'</regex>
    <description>Potential malformed Wazuh enrollment key response (CVE-2026-54084)</description>
    <group>wazuh_agent_enrollment,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED — no patch evidence from any tracked source. The NVD description indicates the fix is in version 4.14.7, but no vendor confirmation or downloaded patch artifact has been verified.

1) Immediate Mitigations (until patch is applied and confirmed)

• Force CA certificate verification on enrollment: Configure agents to require a CA certificate for manager verification. This prevents enrollment against an unverified/rogue manager. Enrollment against an unverified manager is the core precondition for exploitation.
• Segment enrollment traffic: Perform agent enrollment exclusively over trusted network segments or VPN tunnels where MITM positioning is not feasible.
• Monitor enrollment traffic: Deploy the detection rules above to alert on malformed enrollment responses and abnormal agent process termination.
• Consider network-level filtering: If enrollment is only expected from specific manager IPs, implement egress filtering on agents to only allow enrollment traffic to those trusted IPs.
• Restrict enrollment window: Where possible, schedule enrollment during controlled maintenance windows when additional monitoring resources are available.

2) Patch / Upgrade Steps

• Upgrade to Wazuh 4.14.7 or later immediately upon availability. The NVD description confirms this version contains the fix.
• Verify the upgrade using the official Wazuh documentation for agent upgrade procedures.
• After upgrade, validate that the w_enrollment_process_agent_key() routine now properly validates the field count before invoking OS_IsValidName().
• Test the upgrade in a staging environment with a deliberately malformed enrollment response to confirm the agent handles it gracefully (rejects or errors) rather than crashing.

3) Long-Term Hardening

• Centralized configuration management: Use a configuration management system (Ansible, Puppet, SCCM) to enforce consistent Wazuh agent configuration state, ensuring CA verification is enabled where possible.
• Agent version baseline: Maintain a documented minimum agent version policy and automate version drift detection.
• Layer 2 security: Implement 802.1X or equivalent port-based authentication on network segments to prevent rogue device/MITM positioning.
• Continuous vulnerability scanning: Incorporate CVE-2026-54084 into vulnerability scanning workflows to flag any agent running version < 4.14.7.
• Security awareness: Incorporate this pattern into threat hunting exercises — abnormal agent crashes coinciding with enrollment events are a red flag for active exploitation.
• Out-of-band monitoring: Deploy host-level monitoring independent of the Wazuh agent (e.g., Windows Event Log forwarding, syslog directly to a SIEM) so that agent crashes are themselves detectable rather than creating a monitoring blind spot.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-54084 — Official NVD record with description, CVSS vector, and CWE classification.
2. CWE-476 NULL Pointer Dereference: https://cwe.mitre.org/data/definitions/476.html — Common Weakness Enumeration entry describing the vulnerability class.
3. Wazuh Official Site: https://wazuh.com/ — Vendor product page; monitor for official security advisory and 4.14.7 release notes.
4. Wazuh Documentation — Agent Enrollment: https://documentation.wazuh.com/current/user-manual/agent-enrollment.html — Reference for enrollment configuration, including CA certificate settings that mitigate this vulnerability.
5. ATT&CK Technique T1190 (Exploit Public-Facing Application): https://attack.mitre.org/techniques/T1190/ — The MITRE ATT&CK tactic used for the MITRE_TACTIC metadata.

Known threat actor campaigns or exploit-in-the-wild evidence: None reported at this time. No PoC, exploit code, or Nuclei template has been identified. The EPSS score has not yet been assigned by FIRST.org. CISA has not added this CVE to the Known Exploited Vulnerabilities (KEV) catalog.