CVE-2026-74040 Wazuh 3.9.0 before 4.14.8 Arbitrary File Overwrite RCE via process_files_from_worker
A cluster worker can overwrite master configuration files to achieve root remote code execution on the manager and all agents.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-74040?
CVE-2026-74040 is a critical path traversal vulnerability in wazuh-manager, published on 13 Oct 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Wazuh versions from 3.9.0 before 4.14.8 contain an arbitrary file overwrite vulnerability in MasterHandler.process_files_from_worker allowing a cluster worker to overwrite protected master files. Attackers controlling a worker can use a trailing-slash basename bypass and missing extra_valid enforcement to overwrite ossec.conf and agent.conf, achieving root remote code execution across the manager and every agent.
Weakness: CWE-862
Which versions are affected by CVE-2026-74040?
How do I fix CVE-2026-74040?
No fix has been published for CVE-2026-74040 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-74040 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-74040 exists.
Sources
Also known as GHSA-88p6-7cm8-xwj8.