High priorityDisclosed

Advisory · CVE-2026-74034

Missing origin check on Wazuh agent upgrades can expose files as root

Wazuh manager 4.1.0 through the releases before 4.14.8 do not check the origin of agent upgrade commands properly, so an enrolled agent may be able to read arbitrary files as root. VulnCheck rates it CVSS 4.0 8.7.

Advisory published October 13, 2026Independent summary
Vendor
Wazuh
Product
Wazuh manager
Identifier / CWE
CVE-2026-74034
CWE-862
Action timing
Immediate
ELI5

Explain it like I’m five

An agent that should only receive upgrades can turn the upgrade channel around and ask the manager for files it has no business reading, as root.

SIMPLIFIED_ATTACK_PATH03 STEPS
  1. 01Enrolled agent

    An attacker controls an agent enrolled with the Wazuh manager.

  2. 02Upgrade command abused

    The agent sends an upgrade-related custom command whose origin the manager does not verify.

  3. 03Files read as root

    The manager returns arbitrary file content with root-level access.

What happened

Wazuh disclosed CVE-2026-74034 for the manager in releases 4.1.0 through those before 4.14.8. A missing authorization check on the origin of agent upgrade commands can let an enrolled agent read arbitrary files as root.

The vendor’s affected data marks 4.14.8 as the first unaffected release, so upgrading to 4.14.8 or later is the stated fix.

What to do

  1. Inventory every Wazuh manager deployment, including test, training, and individually managed instances.
  2. Apply the vendor fix or upgrade exactly as directed in the linked vendor bulletin or advisory.
  3. Restrict network access to Wazuh manager while remediation is underway, especially for internet-facing instances.
  4. Review application and server logs for upgrade-related commands from agents outside maintenance windows and agents requesting unusual file paths.
  5. Check for accounts, content, or configuration created outside normal change processes, and rotate exposed credentials where access cannot be ruled out.
  6. Verify the deployed version or patch level after remediation.

Management note

The manager-to-agent trust direction is the whole product. Patch to 4.14.8 and review which agents are enrolled.