CVE-2026-74036 Wazuh CVE debrief

Who should care

Defenders responsible for Wazuh agent deployments, particularly those using versions 4.3.0 to 4.14.7, should assess exposure and prioritize upgrading to version 4.14.8 or later. Additionally, security teams and vulnerability management teams should review the vulnerability and its potential impact on their organization. Operators and administrators of Wazuh agents should also be aware of the vulnerability and take necessary steps to mitigate it.

Why it matters

CVE-2026-74036 is a high-severity remote code execution vulnerability in Wazuh 4.3.0 before 4.14.8. Defenders should prioritize verifying exposure, upgrading vulnerable agents, and reviewing SCA policy configurations.

• Verify Wazuh agent versions to determine exposure
• Upgrade vulnerable agents to version 4.14.8 or later
• Review and validate SCA policy configurations
• Monitor for suspicious activity on Wazuh agents

Technical summary

The Wazuh agent is vulnerable to remote code execution due to a flaw in SCA policy trust determination. The vulnerability exists in Wazuh 4.3.0 before 4.14.8 and allows an attacker controlling a manager to write unsigned policy files and reference them to execute command checks as root on agents. This vulnerability can be mitigated by upgrading to version 4.14.8 or later and reviewing SCA policy configurations. The vulnerability has a high CVSS score of 8.6, indicating a high severity level. Defenders should prioritize verifying exposure and upgrading vulnerable agents.

Defensive priority

Defenders should prioritize verifying exposure of Wazuh agents and upgrading to version 4.14.8 or later.

Recommended defensive actions

• Verify Wazuh agent versions and upgrade to 4.14.8 or later if vulnerable
• Review SCA policy configurations and ensure they are properly validated
• Monitor for suspicious activity on Wazuh agents
• Perform a thorough review of the Wazuh agent deployment to identify potential exposure
• Develop a plan to remediate vulnerable agents and implement compensating controls
• Conduct regular security audits to detect and respond to potential threats
• Implement additional monitoring and logging to detect suspicious activity

Evidence notes

The CVE record and source item provide details on the remote code execution vulnerability in Wazuh 4.3.0 before 4.14.8. The vulnerability is due to SCA policy trust being determined by file path rather than configuration source. Defenders should verify exposure, review SCA policy configurations, and monitor for suspicious activity on Wazuh agents. The source item provides additional context on the vulnerability, including its impact on Wazuh agent deployments.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.