Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-74040— Wazuh 3.9.0 before 4.14.8 Arbitrary File Overwrite RCE via process_files_from_worker

Quick assessment

Affected
Wazuh wazuh-manager
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Wazuh 从 3.9.0 版本到 4.14.8 版本之前存在一个任意文件覆盖漏洞，位于 MasterHandler.process_files_from_worker 函数中。该漏洞允许集群中的工作节点（worker）覆盖受保护的主节点（master）文件。控制工作节点的攻击者可以通过利用基名尾部斜杠绕过机制以及缺失的 extra_valid 参数验证，覆盖 ossec.conf 和 agent.conf 文件，从而在管理节点和所有代理节点上实现远程代码执行，获取 root 权限。

CVSS 9.1 · Critical
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-74040

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Wazuh 3.9.0 before 4.14.8 Arbitrary File Overwrite RCE via process_files_from_worker
Source: CVE Program / CVE List V5
Vulnerability Description
Wazuh versions from 3.9.0 before 4.14.8 contain an arbitrary file overwrite vulnerability in MasterHandler.process_files_from_worker allowing a cluster worker to overwrite protected master files. Attackers controlling a worker can use a trailing-slash basename bypass and missing extra_valid enforcement to overwrite ossec.conf and agent.conf, achieving root remote code execution across the manager and every agent.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制缺失
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Wazuh wazuh-manager 3.9.0 ~ 4.14.8 -

II. Public POCs for CVE-2026-74040

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-74040

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-74040 (2)

Vendor Pages for CVE-2026-74040 (1)

Same Patch Batch · Wazuh · 2026-10-13 · 15 CVEs total

CVE-2026-74041 9.1 CRITICAL Wazuh 4.14.3 before 4.14.8 Remote Command Validation Bypass via Case Mismatch
CVE-2026-74043 9.0 CRITICAL Wazuh 4.1.1 before 4.14.8 Path Traversal via Cluster Upload Functions
CVE-2026-74034 7.5 HIGH Wazuh 4.1.0 before 4.14.8 Arbitrary File Read via upgrade_custom Command
CVE-2026-74036 7.2 HIGH Wazuh 4.3.0 before 4.14.8 Remote Code Execution via SCA Command Policies
CVE-2026-74037 7.2 HIGH Wazuh 4.0.0 before 4.14.8 Session Invalidation Bypass in check_token
CVE-2026-74035 7.2 HIGH Wazuh 4.6.0 before 4.14.8 Authentication Bypass via Empty Password in update_user
CVE-2026-74045 7.1 HIGH Wazuh 3.12.0 before 4.14.8 Heap Buffer Overflow in wazuh-analysisd FIM Decoder
CVE-2026-74047 6.5 MEDIUM Wazuh 4.0.0 before 4.14.8 authd.pass Disclosure via Agent 000 Config Endpoint
CVE-2026-74031 6.5 MEDIUM Wazuh 4.1.1 before 4.14.8 Path Traversal File Deletion via Rule/Decoder Delete Helpers
CVE-2026-74033 6.1 MEDIUM Wazuh from 4.1.1 before 4.14.8 Path Traversal in CDB List Cluster Handlers
CVE-2026-93346 5.3 MEDIUM Wazuh 4.0.0 before 4.14.8 API Brute-Force Protection Bypass via Race Condition
CVE-2026-74030 4.9 MEDIUM Wazuh 3.9.0 before 4.14.8 Memory Exhaustion via SCA YAML Alias Expansion
CVE-2026-93347 4.9 MEDIUM Wazuh 4.1.1 before 4.14.8 Path Traversal via Cluster get_list_file
CVE-2026-74032 4.3 MEDIUM Wazuh 4.0.0 before 4.14.8 RBAC Authorization Bypass via /security/actions

IV. Related Vulnerabilities

Same product: wazuh-manager
Same vendor: Wazuh
Same weakness: CWE-862

V. Comments for CVE-2026-74040

No comments yet

Leave a comment