CVE-2026-74034 Wazuh CVE debrief

Who should care

Defenders responsible for Wazuh deployments should assess exposure and prioritize patching based on deployment context. Security teams should monitor for suspicious activity related to upgrade_custom commands.

Why it matters

CVE-2026-74034 is a high-severity vulnerability in Wazuh 4.1.0 before 4.14.8 that allows enrolled agents to read arbitrary files as root via the upgrade_custom command. Defenders should prioritize verifying exposure, assessing potential impact, and applying patches to prevent exploitation.

• Potential for arbitrary file reads as root, allowing exfiltration of sensitive files.
• Possible disruption of system operations through unauthorized file access.
• Need for verification of Wazuh version and exposure to vulnerable versions.
• Priority on applying patches to prevent exploitation.

Technical summary

The vulnerability in Wazuh 4.1.0 before 4.14.8 allows enrolled agents to issue upgrade_custom commands with attacker-controlled file_path, potentially leading to arbitrary file reads as root. This could allow attackers to exfiltrate sensitive files such as /etc/shadow and client.keys. The vulnerability is a result of a missing origin check in wm_agent_upgrade. Attackers can inject an upgrade_custom message over the agent channel to read arbitrary files as root. Defenders should prioritize verifying exposure and assessing potential impact, focusing on Wazuh deployments and ensuring timely application of vendor-provided patches.

Defensive priority

Defenders should prioritize verifying exposure and assessing potential impact, focusing on Wazuh deployments and ensuring timely application of vendor-provided patches.

Recommended defensive actions

• Verify Wazuh deployments to ensure they are running version 4.14.8 or later.
• Assess potential impact and prioritize patching based on deployment context.
• Monitor for suspicious activity related to upgrade_custom commands.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and source item provide details on the vulnerability in Wazuh 4.1.0 before 4.14.8, which allows enrolled agents to issue upgrade_custom commands with attacker-controlled file_path, potentially leading to arbitrary file reads as root.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.