Title: Canonical vulnerabilities no longer appearing in Wazuh CTI

[Fernando Montanher]

Hello,

We noticed an unexpected behavior related to Ubuntu vulnerability detection.

It appears that Canonical vulnerabilities are no longer being displayed on the Wazuh CTI website. At the same time, within the last 24 hours, all kernel vulnerabilities affecting Ubuntu systems in our environments started being reported as resolved, regardless of the Ubuntu version in use.

We were unable to find any official Wazuh announcement, release note, or documentation mentioning a change related to Canonical vulnerability feeds or Ubuntu vulnerability detection.

We have observed the same behavior across multiple independent environments, which suggests that this is not an isolated issue specific to a single deployment.

Could you please confirm whether there has been any recent change to the Canonical vulnerability feed, Wazuh CTI, or the vulnerability detection mechanism for Ubuntu?

Is this behavior expected?

Thank you.

[hasitha.u...@wazuh.com]

Hi Fernando,

Please allow me some time; I’m currently looking into this and will get back to you with an update as soon as possible.

[hasitha.u...@wazuh.com]

I’m unable to find a recent update that changed the CTI site at the moment. However, I can check internally with our team regarding this.

Before doing that, it would be helpful to validate the issue further. Could you please share the details below so I can investigate this further?

To narrow this down, could you grab a few of the resolved kernel vulnerability events in JSON so we can see the full detail?

In the dashboard, go to Vulnerability Detection → Events → Explore agent, select an affected agent, open one of the resolved events (Unable to find any events if so expand the time), and choose JSON View from the option at the top, then copy the JSON. Please share three or four events, and where possible, pick them from agents on different Ubuntu releases rather than all from one host.

Also, the list of CVE IDs so I can look into this further.

[Fernando Montanher]

Thank you for your response.

Below is an example of a kernel vulnerability that was resolved:

{ "_index": "wazuh-alerts-4.x-2026.08.07", "_id": "cCuC258BNRa3fx3gB0DE", "_score": null, "_source": { "input": { "type": "log" }, "agent": { "ip": "1.1.1.1", "name": "TESTE", "id": "100" }, "manager": { "name": "TESTE1" }, "data": { "vulnerability": { "severity": "Medium", "package": { "name": "linux-aws", "version": "7.0.0-1009.9", "architecture": "amd64" }, "published": "2026-05-28T10:16:34Z", "classification": "CVSS", "title": "CVE-2026-46192 affecting linux-aws was solved", "type": "Packages", "reference": "https://git.kernel.org/stable/c/67184f361ab4d9fac6d2b8d5fed6649d496038a4, https://git.kernel.org/stable/c/eb56deaabf127e8985fc91fa6c97bf8a3b062844, https://git.kernel.org/stable/c/ec9d0ddbde6003c303fa5e1d5cd48952852984d8", "score": { "version": "3.1", "base": "5.500000" }, "cve": "CVE-2026-46192", "scanner": { "reference": "https://cti.wazuh.com/vulnerabilities/cves/CVE-2026-46192" }, "enumeration": "CVE", "cvss": { "cvss3": { "base_score": "5.500000" } }, "updated": "2026-06-11T03:11:02Z", "status": "Solved" } }, "rule": { "firedtimes": 20, "mail": false, "level": 3, "pci_dss": [ "11.2.1", "11.2.3" ], "tsc": [ "CC7.1", "CC7.2" ], "description": "The CVE-2026-46192 that affected linux-aws was solved due to an update in the agent or feed.", "groups": [ "vulnerability-detector" ], "id": "23502", "gdpr": [ "IV_35.7.d" ] }, "location": "vulnerability-detector", "decoder": { "name": "json" }, "id": "1786094158.1075666466", "timestamp": "2026-08-07T06:15:58.438-0300" }, "fields": { "data.vulnerability.published": [ "2026-05-28T10:16:34.000Z" ], "data.vulnerability.updated": [ "2026-06-11T03:11:02.000Z" ], "timestamp": [ "2026-08-07T09:15:58.438Z" ] }, "sort": [ 1786094158438 ] }

Another example:

{ "_index": "wazuh-alerts-4.x-2026.08.07", "_id": "NCkf258BNRa3fx3gpd34", "_score": null, "_source": { "input": { "type": "log" }, "agent": { "ip": "teste", "name": "teste", "id": "097" }, "manager": { "name": "teste" }, "data": { "vulnerability": { "severity": "High", "package": { "name": "linux-image-6.8.0-136-generic", "version": "6.8.0-136.136", "architecture": "amd64" }, "published": "2026-04-22T14:16:50Z", "classification": "CVSS", "title": "CVE-2026-31511 affecting linux-image-6.8.0-136-generic was solved", "type": "Packages", "reference": "https://git.kernel.org/stable/c/340666172cf747de58c283d2eef1f335f050538b, https://git.kernel.org/stable/c/3a89c33deffb3cb7877a7ea2e50734cd12b064f2, https://git.kernel.org/stable/c/5f5fa4cd35f707344f65ce9e225b6528691dbbaa, https://git.kernel.org/stable/c/bafec9325d4de26b6c49db75b5d5172de652aae0, https://git.kernel.org/stable/c/2074dfffad76981ca451cb7fc98703d04ac562fe", "score": { "version": "3.1", "base": "7.800000" }, "cve": "CVE-2026-31511", "scanner": { "reference": "https://cti.wazuh.com/vulnerabilities/cves/CVE-2026-31511" }, "enumeration": "CVE", "cvss": { "cvss3": { "base_score": "7.800000" } }, "updated": "2026-05-17T16:16:15Z", "status": "Solved" } }, "rule": { "firedtimes": 1074, "mail": false, "level": 3, "pci_dss": [ "11.2.1", "11.2.3" ], "tsc": [ "CC7.1", "CC7.2" ], "description": "The CVE-2026-31511 that affected linux-image-6.8.0-136-generic was solved due to an update in the agent or feed.", "groups": [ "vulnerability-detector" ], "id": "23502", "gdpr": [ "IV_35.7.d" ] }, "location": "vulnerability-detector", "decoder": { "name": "json" }, "id": "1786087711.712690305", "timestamp": "2026-08-07T04:28:31.023-0300" }, "fields": { "data.vulnerability.published": [ "2026-04-22T14:16:50.000Z" ], "data.vulnerability.updated": [ "2026-05-17T16:16:15.000Z" ], "timestamp": [ "2026-08-07T07:28:31.023Z" ] }, "sort": [ 1786087711023 ] }

Attached is a spreadsheet containing all CVE IDs that were marked as resolved in a specific Ubuntu environment.

My Wazuh version is:

App version: 4.14.6

[hasitha.u...@wazuh.com]

Hi Fernando

I have a few questions regarding this to verify further
Is linux-aws 7.0.0-1009.9 actually the version installed on agent 100, or did the package change? If this CVE genuinely applied and then a real kernel update resolved it, this event is correct. If it resolved while the vulnerable kernel is still installed, that's the issue. 


https://ubuntu.com/security/CVE-2026-46192


The second one also triggered correctly based on the data in the log. However, we need to investigate this behavior further to confirm if it's misbehaving. I suggest sharing the kernel and OS versions as well.
lsb_release -a
uname -r

Also, please share the Syscollector details so we can verify how Syscollector is retrieving the information from the agent.
Please run the following API request:

GET /syscollector/<agentID>/os

Replace <agentID> with the agent ID from which you shared the logs for both events.
This will help us verify the OS information reported by Syscollector and investigate the behavior further.

If you see an older version and the Wazuh Wazuh-triggered event is marked as resolved, Let's try rebuilding the feeds.

I recommend moving both directories aside rather than deleting them:
systemctl stop wazuh-manager

mv /var/ossec/queue/vd \
/var/ossec/queue/vd.bak.$(date +%F)

mv /var/ossec/queue/vd_updater \
/var/ossec/queue/vd_updater.bak.$(date +%F)

systemctl start wazuh-manager

Then check the logs:
tail -f /var/ossec/logs/ossec.log | grep -iE "content-updater|content_manager|vulnerability-scanner"
You will see a new snapshot download.

Before doing this, please make sure there is enough free disk space. The snapshot is around 300 MB compressed but expands to roughly 9.6 GB, so I would keep at least 15 GB free under /var/ossec.

After rebuilding, the vulnerability scan may take some time to complete across the fleet, so I would wait for the scan to finish before comparing the finding counts.

Let me know the update on this.

[Fernando Montanher]

Good morning,

I believe I may not have explained the issue clearly enough before, so I will try to provide some additional details.

On the 7th, several vulnerabilities were automatically marked as resolved, even though no changes had been made to the affected servers. This behavior appears to specifically affect vulnerabilities related to Ubuntu.

The same situation occurred across approximately 10 Wazuh Manager services/instances that I maintain.

When accessing Wazuh CTI and checking the affected systems/products section, I noticed that there is no option to select Canonical as the vendor, as shown in the following image.

Additionally, some vulnerabilities are no longer listed in Wazuh CTI as affecting Ubuntu. However, when checking the information provided directly by Canonical, those same vulnerabilities are still reported as affecting the corresponding Ubuntu versions.

The main issue is that, apparently, all Ubuntu kernel-related vulnerabilities, regardless of the Ubuntu version, have disappeared from the affected products in Wazuh CTI. As a result, these vulnerabilities are no longer being counted by Wazuh and are being reported as resolved, even though no remediation or changes have been performed on the servers.

I would like to confirm whether there has been any recent change to the vulnerability database or to the correlation process between Wazuh CTI and Canonical's security information.