CVE-2026-74037: Wazuh Wazuh-Manager

High severity, CVSS 7.2. EPSS: 0.4% chance of exploitation in the next 30 days.

Wazuh 4.0.0 before 4.14.8 fails to invalidate issued tokens for run_as users with zero static roles, because check_token never consults the blacklist. Attackers with revoked administrator grants can continue authenticating and self-link the administrator role to permanently retain privileged access.

Affected products

• Wazuh Wazuh-Manager: from 4.0.0, before 4.14.8 (fixed in 4.14.8)

Published 2026-10-13. Last modified 2026-10-15.