Wazuh Agent: Remote code execution via SCA command policies
Summary
Wazuh agents from 4.3.0 before 4.14.8 trust Security Configuration Assessment (SCA) policies based on their file path instead of their configuration source. A malicious or compromised Wazuh manager can place an unsigned policy file in the agent's var/incoming directory via the upgrade channel and reference it in shared configuration, so its command checks run as root on the agent. The default sca.remote_commands=0 setting does not prevent this, and the attack requires control of the manager.
Affected
- Wazuh wazuh-agent 4.3.0 to before 4.14.8
- Note: VulDB lists the range as up to 4.14.7; the CNA and NVD list the range as before 4.14.8.
Fixed in
- Upgrade wazuh-agent to 4.14.8 (released 23 September 2026).
- The fix is listed in the release notes as #37953 (Improved SCA policy source validation).
Workaround
- No vendor-published workaround.
- Restrict who can administer the Wazuh manager and monitor the manager's upgrade channel until patched.
Exploitation
- CISA SSVC: exploitation status 'poc', automatable 'no', technical impact 'total'.
- A proof of concept is referenced in the GHSA advisory; ACN reports a public PoC.
- Sources conflict on in-the-wild exploitation (Cystack reports 'Actively exploited'; ACN and ThehackerWire do not). Not verified in CISA KEV at the time of writing.
Our recommendation
- Upgrade the Wazuh manager and all agents to 4.14.8 or later.
- Review manager access rights and treat manager compromise as a risk to all managed endpoints.
- Check agent shared configuration and SCA policy references for unexpected var/incoming paths.
- Monitor agents for unexpected root command execution and file creation in var/incoming.
- Patch other Wazuh CVEs fixed in 4.14.8 at the same time.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Wazuh Release v4.14.8 github.com
- GitHub Security Advisory GHSA-qmhg-366r-jjfp github.com
- VulnCheck Advisory www.vulncheck.com
- Wazuh fix pull request #37953 github.com
- ACN: PoC availability for Wazuh vulnerabilities www.acn.gov.it
- NVD record via Vulners vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 08:31.
Original description (NVD)
Wazuh from 4.3.0 before 4.14.8 contains a remote code execution vulnerability where SCA policy trust is determined by file path rather than configuration source. Attackers controlling a manager can write unsigned policy files to var/incoming via the upgrade channel and reference them to execute command checks as root on agents.
NVD references (4)
- https://github.com/wazuh/wazuh/releases/tag/v4.14.8
- https://github.com/wazuh/wazuh/security/advisories/GHSA-qmhg-366r-jjfp
- https://www.vulncheck.com/advisories/wazuh-4.3.0-before-4.14.8-remote-code-execution-via-sca-command-policies
- https://github.com/wazuh/wazuh/security/advisories/GHSA-qmhg-366r-jjfp
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.