Wazuh manager: Arbitrary file overwrite leading to root RCE via cluster worker
Summary
Wazuh manager versions from 3.9.0 before 4.14.8 allow a cluster worker to overwrite protected master files, including ossec.conf and agent.conf. An attacker controlling a worker, which holds the cluster key, can inject configuration that results in root remote code execution on the manager and, through agent.conf, on every enrolled agent. The attack requires control of a cluster worker and its shared key, so standalone managers without a cluster are not exposed to this path.
Affected
- wazuh-manager 3.9.0 to before 4.14.8 (per CNA VulnCheck)
- Some sources list a narrower range of 4.14.0 to 4.14.8; verify against the vendor advisory
- Fixed status for 3.x branches: Unknown.
Fixed in
- Upgrade to wazuh-manager 4.14.8 or later.
- Fixed status for 3.x branches: Unknown.
Workaround
- No vendor-confirmed workaround. Upgrading is the fix.
- Compensating controls (third-party guidance): restrict write permissions on master configuration directories to the minimum needed, limit which hosts may act as cluster workers, and protect the cluster key.
Exploitation
- CVSS 4.0 score 9.4 (critical); CISA SSVC: exploitation PoC, not automatable, total technical impact.
- A public PoC may exist; sources conflict. Assume it may exist.
- No evidence of exploitation in the wild found; CISA KEV status not verified.
Our recommendation
- Upgrade all clustered Wazuh managers to 4.14.8 or later as a priority.
- Identify any 3.x instances; their fix status is unknown, so plan for an upgrade path.
- Review which systems act as cluster workers and restrict them to trusted, hardened hosts.
- Alert on changes to ossec.conf and agent.conf and review cluster-related activity for anomalies.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Wazuh release v4.14.8 github.com
- Wazuh GitHub security advisory GHSA-88p6-7cm8-xwj8 github.com
- VulnCheck advisory for CVE-2026-74040 www.vulncheck.com
- ACN PoC availability list for Wazuh www.acn.gov.it
- OSV record CVE-2026-74040 osv.dev
- TheHackerWire analysis CVE-2026-74040 www.thehackerwire.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 00:05.
Original description (NVD)
Wazuh versions from 3.9.0 before 4.14.8 contain an arbitrary file overwrite vulnerability in MasterHandler.process_files_from_worker allowing a cluster worker to overwrite protected master files. Attackers controlling a worker can use a trailing-slash basename bypass and missing extra_valid enforcement to overwrite ossec.conf and agent.conf, achieving root remote code execution across the manager and every agent.
NVD references (4)
- https://github.com/wazuh/wazuh/releases/tag/v4.14.8
- https://github.com/wazuh/wazuh/security/advisories/GHSA-88p6-7cm8-xwj8
- https://www.vulncheck.com/advisories/wazuh-3.9.0-before-4.14.8-arbitrary-file-overwrite-rce-via-process-files…
- https://github.com/wazuh/wazuh/security/advisories/GHSA-88p6-7cm8-xwj8
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.