CVE-2026-74041 HIGH

CVE-2026-74041: Wazuh 4.14.3 < 4.14.8 / 4.10.4 Remote Command Validation Bypass via Case Mismatch

Vendor Wazuh
Product wazuh-manager
Weakness CWE-178
Published October 13, 2026
Last update October 26, 2026
View on NVD All CVEs

CVSS base score

8.6/10
Attack vector Network
Attack complexity Low
Privileges required High
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

What the vulnerability does

01Description

Wazuh 4.14.3 before 4.14.8 and 4.10.4 contains a case-sensitivity mismatch between the ossec.conf validator and wazuh-logcollector that bypasses remote-command validation. Authenticated users with manager:update_config can inject an uppercase LOG_FORMAT command localfile that the collector runs as root on reload.

Key dates

02Disclosure timeline

October 13, 2026 CVE published
October 26, 2026 Record updated