Key points
- CVE-2026-74040 affects Wazuh versions 3.9.0 through 4.14.7.
- Attackers can achieve root remote code execution across managers and agents.
- The vulnerability involves arbitrary file overwrite in MasterHandler components.
Wazuh versions from 3.9.0 before 4.14.8 contain a critical security flaw. The National Vulnerability Database rates CVE-2026-74040 as having a CVSS score of 9.4. This defect exists in the MasterHandler.process_files_from_worker function. It allows cluster workers to overwrite protected configuration files on the master node. No patch has been confirmed in the provided source material yet.
In plain English
This issue lets an attacker who controls a worker node change key files. They can bypass checks using a trailing slash in file names. This bypass avoids the extra_valid enforcement rule. The attacker can then replace ossec.conf and agent.conf files. These files control how the security system operates. Changing them gives the attacker root-level access. This access extends to every agent connected to the manager.
The background
The vulnerability is classified under CWE-862, which refers to permission errors. It specifically impacts the Wazuh wazuh-manager product. The flaw has existed since version 3.9.0. It remains present in all releases up to 4.14.7. The description notes that the missing enforcement allows the overwrite. This leads to remote code execution with root privileges. The impact covers the entire cluster infrastructure.
What changes now
Organizations using Wazuh must verify their current version immediately. If the version is older than 4.14.8, the system is vulnerable. Administrators should monitor for vendor updates that address CVE-2026-74040. Until a fix is available, exposure risks are high. Network segmentation may help limit the blast radius. Teams should review worker node access controls carefully.
Who needs to act first
Teams usually prioritize systems exposed to untrusted networks. Check whether your cluster workers can be reached externally. Back up current configurations before making changes. Test any updates in an isolated environment first. Roll out fixes to a small group of managers initially. Monitor logs for unusual file access attempts. Reduce exposure by restricting worker-to-master traffic. Verify that only authorized nodes can send files.
What to do and how to stay safe: Wazuh
- Verify the installed Wazuh manager version against the affected range.
- Restrict network access between cluster workers and master nodes.
- Monitor file integrity on critical configuration files like ossec.conf.
- Plan for immediate deployment once the vendor provides an update.
Step-by-step guide: Emergency Patching: How to Fix Critical Flaws Without Breaking Systems
General security guidance from the Patch Review newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which Wazuh versions are affected by CVE-2026-74040?
Versions from 3.9.0 before 4.14.8 are affected.
What is the CVSS score for this vulnerability?
The NVD rates the CVSS score as 9.4, which is critical.
Does a patch exist for this flaw?
The source material does not confirm that a fix has been released.
