CVE-2026-74040 is a critical arbitrary file overwrite in the Wazuh manager's cluster code (versions 3.9.0 up to, but not including, 4.14.8). According to the advisory, an attacker who controls a cluster worker can use it to get root remote code execution on the manager and every connected agent.
What Is It
The flaw is in MasterHandler.process_files_from_worker, the master-side routine that takes in files sent by cluster workers. The NVD description names two weaknesses that together let a worker overwrite protected files on the master:
- a trailing-slash basename bypass
- missing
extra_validenforcement
An attacker who controls a worker can use these to overwrite ossec.conf and agent.conf. The issue is classified as CWE-862 (Missing Authorization).
Why It Matters
According to the advisory, changing ossec.conf and agent.conf gives the attacker root remote code execution on the manager and on every agent it manages. If that holds, one compromised worker could become code execution across the whole deployment.
VulnCheck's scores:
- CVSS 3.1: 9.1 CRITICAL (
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H). The scope is marked Changed, with high impact to confidentiality, integrity and availability. - CVSS 4.0: 9.4 CRITICAL, with high impact to the vulnerable system and to subsequent systems.
Both vectors require high privileges, because the attacker must already control a cluster worker. Network attack complexity is low, and no user interaction is needed.
The supplied CISA KEV entry is empty, so KEV does not currently confirm active exploitation of this CVE. NVD lists the record's status as "Received", published 2026-10-13.
What's Vulnerable
- Vendor: Wazuh
- Product: wazuh-manager (
pkg:github/wazuh/wazuh) - Affected: 3.9.0 up to, but not including, 4.14.8
- Unaffected: 4.14.8
The affected code handles master/worker cluster file synchronization.
Patch Status
Wazuh 4.14.8 is listed as unaffected, and the references include the v4.14.8 release and a GitHub security advisory (GHSA-88p6-7cm8-xwj8). Administrators running wazuh-manager 3.9.0 through 4.14.7 should upgrade to 4.14.8.
There is no KEV entry, so no CISA-mandated required action or due date applies at this time.