PT-2026-111569

CVE-2026-74041

Published

2026-10-13

Updated

2026-10-22

Description by

CVSS 2.0

9.0

High

MetricsAV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Wazuh versions 4.14.3 through 4.14.7

Description A case-sensitivity mismatch exists between the ossec.conf validator and wazuh-logcollector, allowing the bypass of remote-command validation. Authenticated users possessing the manager:update config permission can inject an uppercase LOG FORMAT command localfile, which the collector then executes as root upon reload.

Recommendations Update to version 4.14.8.

Exploitability

Exploit

Fix

Researchers

Namd0Ng

Vikman90

Vendors

Affected products

Weakness enumeration

CWE-178: Improper Handling of Case Sensitivity

Related identifiers