CVE-2026-74034

Name of the Vulnerable Software and Affected Versions Wazuh versions 4.1.0 through 4.14.7

Description A missing origin check in the wm agent upgrade function allows enrolled agents to issue upgrade custom commands using an attacker-controlled file path variable. This allows attackers to inject an upgrade custom message over the agent channel to read arbitrary files with root privileges, potentially exfiltrating sensitive files such as /etc/shadow and client.keys.

Recommendations Update to version 4.14.8 or later.