CVE-2026-74041 Wazuh 4.14.3 < 4.14.8 / 4.10.4 Remote Command Validation Bypass via Case Mismatch
Authenticated users can bypass command validation to execute arbitrary commands as root on Wazuh managers.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-74041?
CVE-2026-74041 is a high-severity vulnerability in wazuh-manager, published on 13 Oct 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Wazuh 4.14.3 before 4.14.8 and 4.10.4 contains a case-sensitivity mismatch between the ossec.conf validator and wazuh-logcollector that bypasses remote-command validation. Authenticated users with manager:update_config can inject an uppercase LOG_FORMAT command localfile that the collector runs as root on reload.
Weakness: CWE-178
Which versions are affected by CVE-2026-74041?
How do I fix CVE-2026-74041?
No fix has been published for CVE-2026-74041 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-74041 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-74041 exists.
Sources
Also known as GHSA-cjf8-wjx6-hjw6.