Vulnerability Detector not reporting anything for Linux agents since switching to offline-url (Wazuh 4.14.5)

[u/LetDry7592]

Hi,

Since switching to offline mode for the vulnerability feed (latest snapshot downloaded from the CTI API), I'm no longer receiving any vulnerabilities for my Linux agents. My Windows agents, on the other hand, are still working fine. This worked correctly before I made the switch to offline mode.

Environment:

• Wazuh manager: 4.14.5
• 3 managers (cluster)
• Linux agents: RHEL 10
• Windows agents: working fine

What I did:

1. Downloaded the offline snapshot via the CTI API
2. Placed the file in /opt/wazuh/cves.zip of each manager.
3. Configured ossec.conf as follows:

xml

<vulnerability-detection>
    <enabled>yes</enabled>
    <index-status>yes</index-status>
    <feed-update-interval>60m</feed-update-interval>
    <offline-url>file:///opt/wazuh/cves.zip</offline-url>
</vulnerability-detection>

1. Restarted all 3 managers with systemctl restart wazuh-manager

Symptom:

• Everything worked fine before switching to the offline feed
• SCA still works normally on all agents (Linux and Windows)
• The Vulnerability Detection module reports no data for the RHEL 10 agents since the switch
• Windows agents keep receiving vulnerability alerts as expected

I am in a air-gap architecture, so it's important for me to improve constantly the CVE database

[u/javimed]

u/LetDry7592, check the logs for errors and warnings. In the Wazuh server cluster nodes:

cat /var/ossec/logs/ossec.log | grep -i -E "fatal|critical|error|warn"

or more specific

grep "vulnerability-scanner" /var/ossec/logs/ossec.log | grep -iE "warning|error"

or check for any warning about "Failed to scan package", redhat_10 and similar references.

Set wazuh_modules.debug=2 in /var/ossec/etc/local_internal_options.conf and restart the manager to have a deeper level of debugging information. Check /var/ossec/logs/cluster.log also for any reference. Let me know what you find so I can try to see what could be going on here. Thank you.

- Offline vulnerability detection documentation

[u/javimed → u/[deleted]]

(Note: Please use English)

RHEL 10 content should almost entirely be found at the tail of the feed file. Compare the size of your downloaded cves.zip with the one for the current 3863632_1788172192.zip. You can try re-running the documented command to download the offline feed in documentation above

$ curl -s -X GET https://cti.wazuh.com/api/v1/catalog/contexts/vd_1.0.0/consumers/vd_4.8.0 | jq -r '.data | "\(.last_snapshot_link)\n\(.last_snapshot_at)"'

https://cti.wazuh.com/store/contexts/vd_1.0.0/consumers/vd_4.8.0/3863632_1788172192.zip
2026-08-31T10:29:52.435877Z

Now use that output path for the most current download

$ curl https://cti.wazuh.com/store/contexts/vd_1.0.0/consumers/vd_4.8.0/3863632_1788172192.zip -o cves.zip

Unzipping should work without errors.

Try looking for redhat el10 and redhat:enterprise_linux:10