CVE should be fixed but not showing in wazuh
exe
Bony V John
Bony V John
Even after updating the Adobe Acrobat package to a newer version, if that version itself contains known vulnerabilities, it will still appear as vulnerable on the dashboard.
To verify whether this is a false positive, first confirm that the installed package version matches the one reported by Wazuh.
On the endpoint, check the currently installed version of the package that is showing the vulnerability.
Then, on the Wazuh dashboard:
- Click the hamburger menu (top left)
- Go to Server Management > Dev Tools
- Run the following command:
Replace <agent_id> and <package_name> with the relevant values.
Confirm that the version shown in the output matches the version installed on the endpoint.
If the versions match, please share the vulnerability details from the Inventory section for further analysis:
- Go to Vulnerability Detection > Inventory
- Select the affected package
- Switch the view to JSON
- Share the JSON output
This will help determine whether the alert is a false positive. You can also verify the vulnerability details using Wazuh CTI.
By default, the Wazuh agent runs the Syscollector scan every hour. It collects package and system details from the endpoint and forwards them to the Wazuh server.
Run the following command on the endpoint CLI:
If it is running every hour, it should show output similar to:
2025/12/02 11:14:07 wazuh-modulesd:syscollector: INFO: Starting evaluation.
2025/12/02 11:14:10 wazuh-modulesd:syscollector: INFO: Evaluation finished.
2025/12/02 12:14:12 wazuh-modulesd:syscollector: INFO: Starting evaluation.
2025/12/02 12:14:43 wazuh-modulesd:syscollector: INFO: Evaluation finished.
If Syscollector is not running, check the Wazuh agent ossec.conf file using this Wazuh documentation.
If Syscollector is running fine on the endpoint, then on the Wazuh manager, check whether there are any agent sync issues or indexer connection errors in ossec.log. Run the below command on the Wazuh manager CLI:
cat /var/ossec/logs/ossec.log | grep -iE "sync|indexer-connector|error|warn"
Check if there are any error or warning logs related to agent sync or indexer connection.
If you find indexer authentication errors, you can update the Wazuh Indexer username and password in the Wazuh manager keystore using the wazuh-keystore tool:
echo '<WAZUH_INDEXER_USERNAME>' | /var/ossec/bin/wazuh-keystore -f indexer -k username
echo '<WAZUH_INDEXER_PASSWORD>' | /var/ossec/bin/wazuh-keystore -f indexer -k password
Replace <WAZUH_INDEXER_USERNAME> and <WAZUH_INDEXER_PASSWORD> with the correct credentials.
Also, verify the <indexer> configuration section in the Wazuh manager ossec.conf file. You can refer to the Wazuh documentation for configuration validation and more details about updating the keystore.