Remote Code Execution in Wazuh via Unsigned SCA Policy

Executive Summary

CVE-2026-74036 is a high-severity remote code execution flaw in Wazuh versions 4.3.0 to 4.14.7. It occurs because SCA policy trust is based on file path rather than configuration source. Attackers with manager access can exploit this by writing unsigned policy files to var/incoming via the upgrade channel and execute commands as root on agents.

Useful 0 Not Useful 0

Detection Guidance

Check Wazuh manager and agent versions to confirm if they are within the vulnerable range (4.3.0 to 4.14.7). Inspect the var/incoming directory for unexpected or unsigned policy files. Review SCA policy configurations for unauthorized file paths outside etc/shared/. Monitor agent logs for unusual command execution attempts.

Useful 0 Not Useful 0

Impact Analysis

If exploited, attackers with manager access could execute arbitrary commands as root on all connected Wazuh agents. This could lead to full system compromise, data theft, or lateral movement within the network. The vulnerability bypasses security controls and allows unauthorized root-level access.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows remote code execution as root on Wazuh agents, potentially compromising data confidentiality and integrity. For GDPR, it risks unauthorized access to personal data. For HIPAA, it threatens protected health information security. The flaw bypasses security controls, making compliance with these standards difficult without immediate patching.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Wazuh to version 4.14.8 or later immediately. Remove any unauthorized policy files from var/incoming. Validate all SCA policy file paths to ensure they are within trusted directories like etc/shared/. Disable sca.remote_commands if not required. Restrict manager access to prevent unauthorized file uploads.

Useful 0 Not Useful 0