Is CVE-2026-26206 actively exploited?

No active exploitation of CVE-2026-26206 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-26206 be exploited remotely?

Yes. CVE-2026-26206 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-26206?

CVE-2026-26206 has a CVSS score of 6.5 (MEDIUM).

HOME VULNERABILITIESCVE-2026-26206

MEDIUM

CVE-2026-26206

CWE-307Published: April 29, 2026· Updated: Apr 30, 2026

6.5

CVSS v3.1

EPSS:0.04%probability of exploitation in 30 daysPercentile:13.3th

Official Description

Wazuh is a free and open source platform used for threat prevention, detection, and response. From version 4.0.0 to before version 4.14.4, Wazuh's server API brute-force protection for POST /security/user/authenticate can be bypassed by sending concurrent authentication requests. Although the configured threshold (max_login_attempts, default 50) is enforced correctly for sequential requests, a parallel burst allows significantly more failed login attempts to be processed before the IP block is applied. This enables an attacker to perform more password guesses than the configured policy intends (e.g., 100 attempts processed where 50 should be allowed). This issue has been patched in version 4.14.4.

NVD Source

Technical Analysis

CVE-2026-26206 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.