CVE-2026-56699

criticalCVSS 10covered by 1 sourcefirst seen 2026-07-15

Wazuh Manager before 5.0.0-beta3 fails to escape the DataValue.index field when constructing OpenSearch bulk requests, allowing enrolled agents to inject arbitrary NDJSON operations. Attackers can smuggle delete, index, or update operations into bulk requests executed under the manager's admin credentials, enabling document deletion, alert tampering, and cross-agent SIEM state manipulation.

⚡ Watch CVE-2026-56699

Get an email if CVE-2026-56699 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.

Advisory coverage (1)

criticalCVE-2026-56699: Wazuh Manager before 5.0.0-beta3 fails to escape the DataValue.index field when constructing O…nvd · 2026-07-15

External references

NVD record for CVE-2026-56699

CVE.org record

Embed the live status

— this badge updates automatically when the KEV or exploit status changes. How to embed it →

[![CVE-2026-56699 status](https://www.csirts.com/badge/CVE-2026-56699)](https://www.csirts.com/cve/CVE-2026-56699)