CVE-2026-112337— Wazuh 3.7.0 before 4.14.9 SSRF via Azure Graph nextLink Pagination

Quick assessment

Affected

wazuh wazuh

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Wazuh 3.7.0 至 4.14.9 版本（不含 4.14.9）在 Azure wodle 的函数中存在服务端请求伪造（SSRF）漏洞。该函数在跟随时，未对目标主机和 HTTPS 协议进行验证。攻击者若能操控的值，即可将管理器的请求重定向至其控制的端点，从而窃取复用的 Microsoft Graph 访问令牌（Bearer Token），并访问内部服务。

CVSS 3.7 · Low Updated Nov 06, 2026

Possible ATT&CK Techniques 2 AI

T1021.001 · Remote Desktop Protocol T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Wazuh 3.7.0 before 4.14.9 SSRF via Azure Graph nextLink Pagination

Source: CVE Program / CVE List V5

Vulnerability Description

Wazuh from 3.7.0 before 4.14.9 contains a server-side request forgery vulnerability in the Azure wodle get_graph_events() function that follows @odata.nextLink without host or HTTPS validation. Attackers who influence the nextLink value can redirect manager requests to attacker-controlled endpoints, capturing the reused Microsoft Graph bearer token and reaching internal services.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

服务端请求伪造(SSRF)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
wazuh	wazuh	3.7.0 ~ 4.14.9	-

II. Public POCs for CVE-2026-112337

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-112337

请登录查看更多情报信息。

Other References for CVE-2026-112337 (3)

https://github.com/wazuh/wazuh/releases/tag/v4.14.9 release-notes
https://github.com/wazuh/wazuh/security/advisories/GHSA-qxg8-jrjm-w96h vendor-advisory
https://www.vulncheck.com/advisories/wazuh-3.7.0-before-4.14.9-ssrf-via-azure-graph-nextlink-pagination third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-112337

Same Patch Batch · wazuh · 2026-11-06 · 8 CVEs total

CVE-2026-112340	8.2 HIGH	Wazuh 4.9.0 before 4.14.9 Authorization Header Override via /api/request
CVE-2026-112336	6.5 MEDIUM	Wazuh Manager 3.0.0 before 4.14.9 Memory Leak DoS via JSON Decoder
CVE-2026-112341	6.5 MEDIUM	Wazuh before 4.14.9 SQL Injection via WazuhDBBackend _substitute_params
CVE-2026-112338	5.9 MEDIUM	Wazuh from 4.3.0 before 4.14.9 SSRF via GitHub Module Link Pagination
CVE-2026-112339	5.9 MEDIUM	Wazuh 3.9.0 before 4.14.9 Missing TLS Hostname Verification in fluent-forward Module
CVE-2026-112335	5.5 MEDIUM	Wazuh Agent 1.0.0 before 4.14.9 Stack Buffer Overflow via read_snortfull
CVE-2026-112334	4.9 MEDIUM	Wazuh 1.0.0 before 4.14.9 Out-of-Bounds Write in wazuh-execd via ar.conf

IV. Related Vulnerabilities

Same product: wazuh

Same vendor: wazuh

Same weakness: CWE-918