CVE-2026-49441 wazuh CVE debrief

Who should care

System administrators and security teams using Wazuh for threat prevention, detection, and response should assess their exposure and update to a fixed version if necessary. This includes reviewing the Wazuh configuration files for integrity, monitoring for suspicious activity related to file uploads and modifications, and verifying the affected scope and severity of the vulnerability.

Why it matters

CVE-2026-49441 is a critical vulnerability in Wazuh that allows potential code execution via crafted archive upload. System administrators and security teams should assess their exposure and update to a fixed version if necessary. The vulnerability's impact includes potential code execution, overwrite of security-sensitive files, and configuration of root-executed commands. Verification of Wazuh configuration file integrity is required.

• Potential code execution after a service reload.
• Overwrite of security-sensitive files such as ossec.conf.
• Configuration of root-executed commands.
• Verification of Wazuh configuration file integrity is required.

Technical summary

The vulnerability exists in the process_files_from_worker() function in framework/wazuh/core/cluster/master.py. An attacker can exploit this by uploading a crafted extra-valid archive, potentially overwriting security-sensitive files like /var/ossec/etc/ossec.conf, which could lead to code execution after a service reload. This issue affects Wazuh versions from 4.3.0 to 4.14.6 and 5.0.0-beta3, and is fixed in versions 4.14.6 and 5.0.0-beta3. The vulnerability allows potential code execution via crafted archive upload, and its impact includes potential code execution, overwrite of security-sensitive files, and configuration of root-executed commands.

Defensive priority

High

Recommended defensive actions

• Review and update Wazuh to version 4.14.6 or 5.0.0-beta3 if currently using a vulnerable version.
• Verify the integrity of the Wazuh configuration files, especially ossec.conf.
• Monitor for any suspicious activity related to file uploads and modifications in the Wazuh environment.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its CVSS score of 9.1 and severity of CRITICAL. The issue is fixed in versions 4.14.6 and 5.0.0-beta3. To verify exposure, defenders should review the Wazuh configuration files, especially ossec.conf, and monitor for any suspicious activity related to file uploads and modifications in the Wazuh environment. Additionally, system administrators and security teams should assess their exposure and update to a fixed version if necessary. Verification of Wazuh's 4.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.