Loading story…
A critical vulnerability tracked as CVE-2026-56699 affects Wazuh Manager versions before 5.0.0-beta3, allowing an enrolled agent to inject arbitrary NDJSON operations into inventory_sync requests. The flaw stems from improper escaping of the agent-controlled DataValue.index field while the manager builds OpenSearch bulk requests, creating a path for remote exploitation under the manager’s own administrative credentials.
Successful exploitation can allow attackers to perform delete, index, and update actions in OpenSearch, enabling document deletion, alert tampering, and manipulation of SIEM state across agents. The issue is classified as CWE-74, and the published remediation is to upgrade Wazuh Manager to 5.0.0-beta3 or later.
See real exploitation activity before you spend the cycle.
2 events from the most recent confirmed update back to the earliest known activity.
VulnCheck and CVEfeed published details for CVE-2026-56699, a critical Wazuh Manager injection flaw caused by improper escaping of DataValue.index in inventory_sync bulk requests. Reported impact included delete, index, or update actions in OpenSearch using the manager's administrative credentials, enabling document deletion, alert tampering, and SIEM state manipulation.
A critical vulnerability affecting Wazuh Manager versions before 5.0.0-beta3 was addressed by making version 5.0.0-beta3 or later the published fix. The flaw allowed an enrolled agent to inject arbitrary NDJSON operations into OpenSearch bulk requests via the DataValue.index field.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
2 references tracked. Mallory keeps watching after this page renders.
vulncheck.com
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical `CVSS 10.0` vulnerability in **Wazuh Manager 5.0** allows a malicious or compromised agent to inject unauthorized OpenSearch bulk operations through the `inventory_sync` pipeline, enabling deletion of alerts, tampering with forensic evidence, and manipulation of backend SIEM data. The flaw stems from Wazuh forwarding the agent-controlled `DataValue.index` flatbuffer field into bulk `NDJSON` requests without proper escaping, causing injected `delete`, `index`, or `update` actions to run with the manager’s high-privilege OpenSearch credentials. Public reporting said the issue affects `wazuh-manager` from `5.0.0-beta1`, while `4.x` branches are not affected because they do not include the vulnerable inventory synchronization path. Researchers and public advisories said the exposure can be especially severe in deployments where `wazuh-authd` allows anonymous agent enrollment, potentially lowering the barrier to exploitation from authenticated abuse to practical unauthenticated access in some environments. Reported impacts include cross-index document deletion, post-compromise cleanup, persistent payload injection into saved dashboard objects, and interference with incident response and investigations. Wazuh fixed the issue in `5.0.0-beta3`, and the vulnerability is tracked as `GHSA-ff9g-85jq-r3g3`; defenders were urged to upgrade, disable anonymous enrollment, reduce indexer privileges, and review logs for unauthorized index modifications.
Jun 29, 2026
**CVE-2025-26399** is a **critical insecure deserialization** flaw (CWE-502) in *SolarWinds Web Help Desk* that enables **unauthenticated remote code execution/command execution** over the network. The issue resides in the product’s **`AjaxProxy`** component, where untrusted serialized data can be processed without sufficient validation, allowing an attacker to deliver a crafted payload that results in arbitrary command execution on the host running the help desk application. Multiple reports indicate the vulnerability is **actively exploited in the wild**, prompting **CISA** to add CVE-2025-26399 to the **Known Exploited Vulnerabilities (KEV)** catalog. NetSPI notes the flaw was disclosed in 2025 and is described as a **patch bypass** related to earlier issues (**CVE-2024-28988** and **CVE-2024-28986**), and recommends immediate remediation by upgrading to **SolarWinds Web Help Desk 12.8.7 Hotfix 1 or later**; if patching is delayed, organizations should restrict network exposure of the server and increase monitoring for suspicious process execution and outbound connections.
Jun 29, 2026
ManageEngine has patched a critical unauthenticated remote code execution flaw in **ADAudit Plus** tracked as `CVE-2026-6516`, affecting all builds earlier than **8606**. The vulnerability resides in the product's Agent API and stems from a chain involving an authentication bypass and a path traversal issue, enabling attackers to execute code remotely without credentials. The issue is classified under `CWE-78`, and public reporting lists a severe network-exploitable attack path with high confidentiality and integrity impact. Zoho/ManageEngine assigned the flaw a **CVSS 10.0** score and released a fix in **build 8606**, advising customers to update the ADAudit Plus server as well as affected Windows and Mac agents. The vendor said there was no confirmed exploitation in the wild and no public proof-of-concept at the time of disclosure. The vulnerability was reported by **Linhlt of VCB**.
Jul 24, 2026