CVE-2026-74040
Received Received - Intake

Arbitrary File Overwrite in Wazuh Manager via Worker Bypass

Publication date: 2026-10-13

Last updated on: 2026-10-13

Assigner: VulnCheck

Description
Wazuh versions from 3.9.0 before 4.14.8 contain an arbitrary file overwrite vulnerability in MasterHandler.process_files_from_worker allowing a cluster worker to overwrite protected master files. Attackers controlling a worker can use a trailing-slash basename bypass and missing extra_valid enforcement to overwrite ossec.conf and agent.conf, achieving root remote code execution across the manager and every agent.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-13
Last Modified
2026-10-13
Generated
2026-10-13
AI Q&A
2026-10-13
EPSS Evaluated
N/A
NVD
CVE-2026-74040
EUVD
EUVD-2026-98676

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Wazuh wazuh-manager 3.9.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-74040 is an arbitrary file overwrite vulnerability in Wazuh Manager versions 3.9.0 to 4.14.7. It allows a cluster worker to overwrite critical master files like ossec.conf and agent.conf by bypassing path restrictions using trailing slashes and missing authorization checks. This enables attackers to achieve root remote code execution on the manager and all enrolled agents.

Detection Guidance

Check Wazuh Manager versions between 3.9.0 and 4.14.7 for the vulnerability. Inspect cluster logs for suspicious file write operations or unauthorized modifications to ossec.conf or agent.conf. Look for trailing-slash paths in cluster metadata keys. Verify if extra_valid flag enforcement is missing in MasterHandler.process_files_from_worker function.

Impact Analysis

Attackers exploiting this vulnerability can overwrite configuration files on the Wazuh manager and push malicious settings to all connected agents. This leads to root-level remote code execution across the entire Wazuh deployment, enabling full system compromise, data theft, and lateral movement within the network.

Compliance Impact

This vulnerability compromises system integrity and confidentiality, potentially violating GDPR's data protection requirements and HIPAA's security rules. A successful exploit could lead to unauthorized access to sensitive data, triggering compliance violations and regulatory penalties.

Mitigation Strategies

Upgrade Wazuh Manager to version 4.14.8 or later immediately. Apply patches that enforce canonical file path checks and extra_valid flag validation. Review cluster.json for unauthorized file entries and remove suspicious paths. Monitor for unexpected configuration changes in ossec.conf and agent.conf files.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-74040. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart