CVE-2026-74040

Name of the Vulnerable Software and Affected Versions Wazuh versions 3.9.0 through 4.14.7

Description An arbitrary file overwrite issue exists in the MasterHandler.process files from worker() function. A compromised cluster worker can bypass protections using a trailing-slash basename bypass and the absence of extra valid enforcement to overwrite protected master files, specifically ossec.conf and agent.conf. This allows for root remote code execution across the manager and all associated agents. Exploitation requires a cluster key or privileged API access.

Recommendations Update to version 4.14.8.