All vulnerabilities
CVE-2026-74040GHSA-88p6-7cm8-xwj8

wazuh-manager: Wazuh 3.9.0 before 4.14.8 Arbitrary File Overwrite RCE via process_files_from_worker

Wazuh wazuh-manager
Open in ThreatlineRecord JSON
CVSS
9.4Critical
ExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 16 Oct 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.55%Chance of exploitation activity in the next 30 days, higher than 45% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in4.14.8Fixed versionCVE List
Published13 Oct 2026Updated 16 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Wazuh versions from 3.9.0 before 4.14.8 contain an arbitrary file overwrite vulnerability in MasterHandler.process_files_from_worker allowing a cluster worker to overwrite protected master files. Attackers controlling a worker can use a trailing-slash basename bypass and missing extra_valid enforcement to overwrite ossec.conf and agent.conf, achieving root remote code execution across the manager and every agent.

Text from CVE List

Affected versions 2

  • wazuh-manageraffected: 3.9.0 before 4.14.8CVE List
  • wazuh-managerunaffected: 4.14.8CVE List

References 3