CVE-2026-74041 is a critical flaw in Wazuh manager 4.14.3 through 4.14.7. A user with configuration-update rights can get past remote-command validation and make wazuh-logcollector run commands as root.
What Is It
The validator for ossec.conf and the wazuh-logcollector component handle letter case differently. Because of this mismatch, the validator's remote-command check can be bypassed.
An authenticated user with the manager:update_config permission can inject a localfile entry whose LOG_FORMAT command value is written in uppercase. The validator lets it through, and the collector then runs that command as root the next time the configuration reloads.
The issue is classified as CWE-178 (improper handling of case sensitivity). VulnCheck disclosed it, and NVD published it on 2026-10-13. Its NVD status is currently "Received."
Why It Matters
- CVSS 3.1: 9.1 (CRITICAL). Vector:
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H - CVSS 4.0: 9.4 (CRITICAL)
The attack works over the network, is low in complexity and needs no user interaction. It does require high privileges, meaning an account that can update the manager configuration.
Once that condition is met, the attacker gets root command execution on the Wazuh manager. The scope is rated "Changed," with high impact to confidentiality, integrity and availability. In CVSS 4.0, the impact on subsequent systems is also rated high.
The Wazuh manager is the central hub of a security monitoring deployment. If an account with config rights is compromised or abused, it becomes a path to root on that hub.
Exploitation status: None of the sources cited here report active exploitation.
What's Vulnerable
- Vendor/Product: Wazuh,
wazuh-manager(github.com/wazuh/wazuh) - Affected: version 4.14.3 up to, but not including, 4.14.8
- Not affected: 4.14.8. The record lists all other versions as unaffected by default.
Patch Status
The fix is in Wazuh 4.14.8. Organizations running wazuh-manager 4.14.3 through 4.14.7 should upgrade to 4.14.8.
The vendor release notes and GitHub security advisory GHSA-cjf8-wjx6-hjw6 are listed under Sources. Because exploitation requires manager:update_config, also check which accounts hold that permission.