Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.6
CVE-2026-74036: Wazuh agent allows attacker to run commands as root
CVE-2026-74036 · published 2 days ago
Summary
Versions of the Wazuh agent from 4.3.0 up to 4.14.7 let a compromised manager place a crafted file on the server and have agents execute it with full system privileges. This can let an attacker run any command on the monitored machines. Update the agents to version 4.14.8 or later, and remove any unauthorized policy files from the upgrade directory.
What to do
- Update wazuh wazuh-agent to version 4.14.8 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| wazuh | wazuh-agent | < 4.14.8 |
Original advisory text
Wazuh 4.3.0 before 4.14.8 Remote Code Execution via SCA Command Policies
Wazuh from 4.3.0 before 4.14.8 contains a remote code execution vulnerability where SCA policy trust is determined by file path rather than configuration source. Attackers controlling a manager can write unsigned policy files to var/incoming via the upgrade channel and reference them to execute command checks as root on agents.
References
- https://github.com/wazuh/wazuh/releases/tag/v4.14.8
- https://www.vulncheck.com/advisories/wazuh-4.3.0-before-4.14.8-remote-code-execu...
- https://github.com/wazuh/wazuh/security/advisories/GHSA-qmhg-366r-jjfp
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/74xxx/CVE-2026-74036... Vendor Advisory
- https://github.com/wazuh/wazuh Product
- https://nvd.nist.gov/vuln/detail/CVE-2026-74036 Vendor Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Severity
8.6
High
Type
CWE-863Incorrect Authorization
Timeline
Published13 Oct 2026
Updated15 Oct 2026
First seen13 Oct 2026
Track software like this
Free during beta