Patchfirst
Patchfirst
CVE-2026-74040 Critical · 9.1 EPSS 0.7%

Wazuh versions from 3.9.0 before 4.14.8 contain an arbitrary file overwrite vulnerability in…

Wazuh · wazuh-manager

Summary

Wazuh versions from 3.9.0 before 4.14.8 contain an arbitrary file overwrite vulnerability in MasterHandler.process_files_from_worker that allows a cluster worker to overwrite protected master files, including ossec.conf and agent.conf, leading to root remote code execution across the manager and every agent. This affects Wazuh wazuh-manager deployments using the affected versions.

Official description · NVD

Wazuh versions from 3.9.0 before 4.14.8 contain an arbitrary file overwrite vulnerability in MasterHandler.process_files_from_worker allowing a cluster worker to overwrite protected master files. Attackers controlling a worker can use a trailing-slash basename bypass and missing extra_valid enforcement to overwrite ossec.conf and agent.conf, achieving root remote code execution across the manager and every agent.

Breakdown
19.3 / 100
Exploited
Not confirmed
Reports
0
Tactics
0/15

Disclosed on 13 Oct 2026. No public exploit code or confirmed exploitation is recorded.

techniques

No techniques linked

No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.

What security researchers reported

Not named in any threat report yet

Also mentioned in 8 community threat pulses (AlienVault OTX)

Weaker evidence

Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.

References

3 links, grouped by NVD tag (1 duplicate merged)

Other 3

github.com/wazuh/wazuh/releases/tag/v4.14.8github.com/wazuh/wazuh/security/advisories/GHSA-88p6-7cm8-xwj8vulncheck.com/advisories/wazuh-3.9.0-before-4.14.8-arbitrary-file-overwrite-rce-via-process-files-from-worker
↑ ↓ chooseEnter openEsc close