CVE-2026-74041: Wazuh Wazuh-Manager

Critical severity, CVSS 9.1. EPSS: 0.4% chance of exploitation in the next 30 days.

Wazuh 4.14.3 before 4.14.8 contains a case-sensitivity mismatch between the ossec.conf validator and wazuh-logcollector that bypasses remote-command validation. Authenticated users with manager:update_config can inject an uppercase LOG_FORMAT command localfile that the collector runs as root on reload.

Affected products

• Wazuh Wazuh-Manager: from 4.14.3, before 4.14.8 (fixed in 4.14.8)

Published 2026-10-13. Last modified 2026-10-14.