CVE-2026-74041
Received Received - Intake

Wazuh Remote Command Injection via ossec.conf Validation Bypass

Publication date: 2026-10-13

Last updated on: 2026-10-13

Assigner: VulnCheck

Description
Wazuh 4.14.3 before 4.14.8 contains a case-sensitivity mismatch between the ossec.conf validator and wazuh-logcollector that bypasses remote-command validation. Authenticated users with manager:update_config can inject an uppercase LOG_FORMAT command localfile that the collector runs as root on reload.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-13
Last Modified
2026-10-13
Generated
2026-10-13
AI Q&A
2026-10-13
EPSS Evaluated
N/A
NVD
CVE-2026-74041
EUVD
EUVD-2026-98677

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Wazuh wazuh-manager 4.14.3

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-178 The product does not properly account for differences in case sensitivity when accessing or determining the properties of a resource, leading to inconsistent results.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-74041 is a critical vulnerability in Wazuh Manager versions 4.14.3 to 4.14.7. It allows authenticated users with manager:update_config permissions to bypass remote command validation and execute arbitrary commands as root. The issue occurs due to a case-sensitivity mismatch between the ossec.conf validator (case-sensitive) and wazuh-logcollector executor (case-insensitive). Attackers can inject an uppercase LOG_FORMAT command that bypasses validation but is executed as root during configuration reload.

Detection Guidance

Check Wazuh Manager versions between 4.14.3 and 4.14.7 for the vulnerability. Inspect configuration files for uppercase LOG_FORMAT tags in localfile sections. Monitor logs for unexpected root command executions after configuration reloads.

Impact Analysis

This vulnerability allows attackers with valid credentials to gain root access on the Wazuh Manager system. They can execute arbitrary commands, potentially leading to full system compromise, data theft, or disruption of services. The impact includes unauthorized code execution, privilege escalation, and potential lateral movement within the network.

Compliance Impact

This vulnerability could lead to severe compliance violations under GDPR and HIPAA due to unauthorized root access and potential data breaches. GDPR requires protection of personal data and breach notification, while HIPAA mandates safeguards for protected health information. A successful exploit could result in unauthorized data access, triggering mandatory breach reporting and significant fines.

Mitigation Strategies

Upgrade Wazuh Manager to version 4.14.8 or later immediately. Remove or restrict manager:update_config permissions for non-admin users. Review and audit configuration changes via REST API or cluster protocols.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-74041. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart