Multiple vulnerabilities affecting Wazuh

Wazuh is an open source security platform designed for threat detection, incident management and compliance. It collects and analyzes security data from agents deployed on systems. This product is affected by several vulnerabilities labeled as follows: CVE-2026-74041 (CVSS 9.1): This vulnerability is due to a case sensitivity inconsistency between the ossec.conf validator and wazuh-logcollector, bypassing remote command validation. Exploitation of this vulnerability would allow an authenticated attacker with manager:update_config privileges to inject an uppercase LOG_FORMAT command into a localfile that the collector executes as root during a reload. CVE-2026-74040 (CVSS 9.1): This vulnerability is due to an arbitrary file write in MasterHandler.process_files_from_worker. Exploitation of this vulnerability would allow an attacker controlling a cluster worker node to overwrite protected master files, such as ossec.conf and agent.conf, and achieve remote arbitrary code execution with root privileges on the manager and all agents. CVE-2026-74043 (CVSS 9.0): This vulnerability arises from a path traversal flaw in the file upload functions upload_list_file, upload_rule_file, and upload_decoder_file. Exploitation of this vulnerability would allow an attacker holding the cluster key to issue DistributedAPI requests with ../ sequences in the filename, bypassing REST controller validation, in order to write files to arbitrary locations as the Wazuh user. CVE-2026-74034 (CVSS 7.5): This vulnerability results from a lack of origin verification in wm_agent_upgrade. Exploitation of this vulnerability would allow an attacker with a registered agent to issue upgrade_custom commands with a file path they control to read arbitrary files as root, such as /etc/shadow and client.keys. CVE-2026-74036 (CVSS 7.2): This vulnerability is caused by a determination of the trust of Security Configuration Assessment (SCA) policies based on the file path rather than the configuration source. Exploitation of this vulnerability would allow a malicious actor controlling a manager to write unsigned policy files through the update channel and reference them to execute commands as root on agents. CVE-2026-74037 (CVSS 7.2): This vulnerability is due to a failure to invalidate tokens issued for run_as users with null static roles. Exploitation of this vulnerability would allow a malicious actor whose administrator rights have been revoked to continue authenticating and maintain permanent privileged access. CVE-2026-74035 (CVSS 7.2): This vulnerability is due to the placement of the guardrail on reserved accounts and the password policy inside a non-empty value test in security.update_user. Exploitation of this vulnerability would allow an attacker with delegated user administration rights to submit a blank password to the update endpoint, bypass this guardrail to take control of the wazuh superuser account, and authenticate without a credential. CVE-2026-74045 (CVSS 7.1): This vulnerability results from a heap buffer overflow within the fim_generate_alert() function, where the full_log field is sized according to the data received while its writing is bounded by OS_MAXSTR. Exploitation of this vulnerability would allow a malicious actor with a registered agent to issue a specially crafted File Integrity Monitoring (FIM) event to corrupt manager memory and cause the wazuh-analysisd process to terminate, disrupting detection across the entire fleet. CVE-2026-74047 (CVSS 6.5): This vulnerability results from information disclosure via the unmasked agent configuration endpoint. Exploitation of this vulnerability would allow an authenticated, low-privileged attacker (agent:read) to retrieve the authd.pass registration password in clear text, allowing malicious agent registration. CVE-2026-93346 (CVSS 5.3): This vulnerability is caused by a race condition in the throttling of API connection attempts. Exploiting this vulnerability would allow an unauthenticated attacker to bypass brute force attack protection and make an unlimited number of login attempts to guess the password.

• CVE-2026-74041: Wazuh versions from 4.14.3 to 4.14.7;
• CVE-2026-74040: Wazuh versions from 3.9.0 to 4.14.7;
• CVE-2026-74043: Wazuh versions from 4.1.1 to 4.14.7;
• CVE-2026-74034: Wazuh versions from 4.1.0 to 4.14.7;
• CVE-2026-74036: Wazuh versions from 4.3.0 to 4.14.7;
• CVE-2026-74037, CVE-2026-74047, CVE-2026-93346: Wazuh versions from 4.0.0 to 4.14.7;
• CVE-2026-74035: Wazuh versions from 4.6.0 to 4.14.7;
• CVE-2026-74045: Wazuh versions from 3.12.0 to 4.14.7;