Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.4
CVE-2026-74041: Wazuh manager allows privileged users to run root commands
CVE-2026-74041 · published 2 days ago
Summary
Versions of the Wazuh manager before 4.14.8 have a mismatch in how they check configuration files, allowing users who can change settings to add an uppercase LOG_FORMAT command. That command is executed by the log collector with full system privileges, potentially letting an insider run unauthorized actions. Update to version 4.14.8 or later and limit the manager:update_config permission to trusted administrators.
What to do
- Update wazuh wazuh-manager to version 4.14.8 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| wazuh | wazuh-manager | < 4.14.8 |
Original advisory text
Wazuh 4.14.3 before 4.14.8 Remote Command Validation Bypass via Case Mismatch
Wazuh 4.14.3 before 4.14.8 contains a case-sensitivity mismatch between the ossec.conf validator and wazuh-logcollector that bypasses remote-command validation. Authenticated users with manager:update_config can inject an uppercase LOG_FORMAT command localfile that the collector runs as root on reload.
References
- https://github.com/wazuh/wazuh/releases/tag/v4.14.8 Patch
- https://github.com/wazuh/wazuh Product
- https://nvd.nist.gov/vuln/detail/CVE-2026-74041 Vendor Advisory
- https://github.com/wazuh/wazuh/security/advisories/GHSA-cjf8-wjx6-hjw6 Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/74xxx/CVE-2026-74041... Vendor Advisory
- https://www.vulncheck.com/advisories/wazuh-4.14.3-before-4.14.8-remote-command-v... Vendor Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Severity
9.4
Critical
Type
CWE-178Improper Handling of Case Sensitivity
Timeline
Published13 Oct 2026
Updated15 Oct 2026
First seen13 Oct 2026
Track software like this
Free during beta