GitHub Release: wazuh/wazuh v4.14.9-rc2 (08.10.2026)

What's Changed

• Bump 4.14.9 branch by @wazuhci in #38210


• Merge 4.14.8 into 4.14.9 by @jotacarma90 in #38257


• Reject symlinks when writing files staged under the incoming directory by @cborla in #38267


• Windows agent: safer MSI upgrade under a pending system restart by @vikman90 in #38277


• Merge 4.14.8 into 4.14.9 by @jotacarma90 in #38387


• Prevent the agent from stopping Active Response when too many commands are defined by @vikman90 in #38410


• Fix WPK agent upgrade silently failing on systems without the find binary by @Darioortegaleyva in #38431


• Backport: Free rpm macro context to stop unbounded growth by @anromerom in #38366


• Resolve group names once per scan instead of once per user and group by @anromerom in #38395


• Bound the control message copy to the source string length in remoted by @vikman90 in #38427


• Close idle pre-authentication connections in the cluster server by @vikman90 in #38449


• Detect and recover from silently half-closed TCP connections by @cborla in #38401


• Own the systemd D-Bus connection so the services collector recovers after a bus restart by @anromerom in #38392


• Bound Snort full record appends to the available buffer space by @vikman90 in #38472


• Merge 4.14.8 into 4.14.9 by @jotacarma90 in #38523


• Fix memory leak in the analysisd JSON decoder when an event repeats a field by @vikman90 in #38548


• syscollector normalizer: stop erasing while iterating in removeExcluded() (4.14.9) by @Miguevrgo in #38340


• Raise the number of Active Response commands the agent can load by @vikman90 in #38509


• Pin the Azure Graph pagination URL to the Microsoft Graph endpoint by @vikman90 in #38594


• Reject symlinks when reading and staging files during agent upgrade by @hernanvalenzuela in #38493


• Fix false positives for Debian backports packages in Vulnerability Detection by @jotacarma90 in #38474


• Remove leftover Login Item configuration by @rjcausarano in #38613


• Verify the Fluentd server identity in the fluent-forward module by @vikman90 in #38686


• Merge 4.14.8 into 4.14.9 by @jotacarma90 in #38707


• Make the OS_StrBreak() loop guard underflow-safe when the part count is zero by @vikman90 in #38625


• Sanitize the Fluentd server strings written to the log by @vikman90 in #38692


• Validate API pagination URLs before following them by @vikman90 in #38688


• Prevent Linux audit plugin starvation when the Wazuh agent starts during a manager outage by @Darioortegaleyva in #38382


• Backport: Fixed the parameter for debug symbols used in package generation by @MarcelKemp in #38702


• Align the API force parameter with its OpenAPI schema by @vikman90 in #38804


• Fix correctness defects in the active response username handling by @vikman90 in #38637


• Return failure when disable-account cannot run by @vikman90 in #38645


• Removing dead arm for ebpf and fixing memory leak by @Miguevrgo in #38545


• Enable compiler hardening flags on agent binaries by @Miguevrgo in #38571


• Fix gcloud wodle hiding missing-dependency errors behind AttributeError by @Darioortegaleyva in #38856


• Escape control characters in the API access log path by @jotacarma90 in #38894


• Modify Multiple Checks to Fix Deprecated commands in Apple macOS 26.0 SCA file by @IsExec in #38669


• Merge 4.14.8 into 4.14.9 by @TomasTurina in #38946


• Fix process inventory name truncated to fifteen characters by @Darioortegaleyva in #38969


• Fix false-pass on CIS Amazon Linux 2023 minimum password-change-days check by @Darioortegaleyva in #39047


• Report per-user is_remote in the users inventory and recover two /etc/shadow fields by @nbertoldo in #39010


• Fix gcloud: defer bucket/pubsub imports to isolate broken deps by @MAnDumu in #38868


• monitor /private/etc instead of the /etc symlink in the macOS default config by @hernanvalenzuela in #39149


• Update embedded CPython to 3.10.21 and refresh Python dependencies by @TomasTurina in #39148


• Validate active response usernames against an allowlist by @vikman90 in #38651


• Merge 4.14.8 into 4.14.9 by @jotacarma90 in #39208


• SELinux permissive-mode SCA checks false-failing on compliant hosts by @Darioortegaleyva in #39166


• Protect real secret paths in the default agent FIM nodiff list (4.14.9) by @Darioortegaleyva in #39124


• Correct devtmpfs detection in fim filesystem skip by @Darioortegaleyva in #38627


• Fix missing FIM inventory for files with non-ANSI names on Windows by @Darioortegaleyva in #38301


• Fix agent crash from unlocked reads of the FIM directories list on the whodata thread by @Darioortegaleyva in #39207


• Fix gcp: surface the gcloud wodle's raw output on undiagnosable failures by @MAnDumu in #38943


• Fix sca: restore line structure to CIS AL2023 remediation scripts by @MAnDumu in #39073


• Stop the default Windows System32 restrict list from being replaced by a duplicate by @MAnDumu in #39222


• Filter DEAD_PROCESS utmpx entries out of macOS logged-in users provider by @rjcausarano in #39313


• Add us-gov-east-1 and us-gov-west-1 regions to the AWS wodle by @Miguevrgo in #39401


• Compare port objects directly when deduplicating macOS ports by @Miguevrgo in #39324


• Report password status and hash algorithm in the macOS users inventory by @nbertoldo in #39356


• Resolve group-based sudo grants in the users inventory instead of matching sudoers headers by substring by @lchico in #39368


• Prevent the macOS agent from shipping empty ossec.log/ossec.json placeholders by @hernanvalenzuela in #39152


• Merge 4.14.8 into 4.14.9 by @jotacarma90 in #39441


• Report reclaimable memory as available in macOS RAM inventory by @anromerom in #39371


• Compute login_status from any matched session, not just the last one (macOS, Linux, Windows) by @rjcausarano in #39369


• Take macOS process names from the executable path instead of the truncated pbi_name field by @lchico in #39422


• Report an unavailable CPU speed as unavailable on Apple Silicon macOS by @anromerom in #39418


• Substitute wazuh-db query parameters in a single pass by @jotacarma90 in #39494


• Bound the Store app version string to the length VerQueryValueA returns by @lchico in #39467


• Address Coverity findings CID 1678717 and CID 1678718 by @hernanvalenzuela in #39425


• Report SUSE Linux Enterprise service packs in dotted notation by @anromerom in #39524


• Ignore the eBPF whodata provider option on Windows by @Miguevrgo in #39479


• Fix nologin regex error in Ubuntu and Debian by @IsExec in #39474


• Fix macOS syscollector process and port inventory truncation by @MAnDumu in #39146


• Fix broken checks with command wrapper in multiple SCA files by @IsExec in #38679


• Re-own ossec-era files on macOS before removing the legacy accounts by @Miguevrgo in #39398


• Cache identity lookups in the eBPF whodata consumer by @Miguevrgo in #39508


• Indexer connector silent divergence by @MiguelazoDS in #39041


• Make the run_as auth-context payload limit configurable by @MiguelazoDS in #39471


• Logcollector: silence false error on macOS log stream graceful shutdown by @Darioortegaleyva in #38767


• fix: keep macOS queue/sockets at 770 in the package postinstall by @Miguevrgo in #39399


• Resolve the security_inode_setattr dentry argument without the kernel version by @Miguevrgo in #39570


• Vulnerability scanner stops processing inventory events while the CTI feed applies a backlog of offsets by @jepalfer in #39478


• Fix agent-000 config test and DELETE endpoints 401 retries by @jepalfer in #39549


• Pre-authentication enrolment denial: idle TCP connections exhaust authd's 1000-slot pool and are never reclaimed by @jepalfer in #39539


• Build the libbpf-bootstrap precompiled with Zig by @Miguevrgo in #39604


• Allow FIM eBPF whodata on capable kernels older than 5.8 by @Miguevrgo in #39600


• Add a real -Stage parameter to generate_wazuh_msi.ps1 (4.14.9) by @Darioortegaleyva in #39229


• Open agent upgrade staging files without openat() on HP-UX by @lchico in #39719


• Fix the Windows agent CA check on clean hosts and default to the Azure signing root (4.14.9) by @Darioortegaleyva in #39603


• Resolve the FIM eBPF kprobe paths from the mount claimed for write by @Miguevrgo in #39708


• Refresh Linux agent checkfiles sizes for 4.14.9 by @Miguevrgo in #39749


• Backport authd key-indexing fix and log silent VD report delivery failures by @MiguelazoDS in #39651


• Windows agent MSI: only block on pending restart operations that affect the agent by @Darioortegaleyva in #39746


• Bump 4.14.9 branch by @wazuhci in #39811


• Add CHANGELOG entry for the narrowed Windows agent MSI pending-restart check by @Darioortegaleyva in #39806


• Replace private repository links in the changelog with the public pull requests by @jotacarma90 in #39821


• Expect the install-time ossec.log and no ossec.json in the macOS package file check by @nbertoldo in #39838


• Open agent upgrade staging files without openat() or O_NOFOLLOW on AIX by @lchico in #39839


• Ship the macOS agent log placeholders again until the empty JSON archive fix is validated by @nbertoldo in #39849


• Initialize Winsock before IP validation in Windows active response by @hernanvalenzuela in #40084


• Fix the indexer connector deletions broken by the sibling-sweep fix by @jotacarma90 in #40055


• Bump 4.14.9 branch by @wazuhci in #40157


• Add the missing 4.14.9 changelog entry for the Windows active response Winsock fix by @jotacarma90 in #40159

Full Changelog: v4.14.8...v4.14.9-rc2