High priorityDisclosed

Advisory · CVE-2026-74036

Wazuh SCA policy trust flaw can run unsigned commands as root on agents

Wazuh agent 4.3.0 through the releases before 4.14.8 trust SCA policy files by path, so whoever controls the manager side may be able to run unsigned policy commands as root on agents. VulnCheck rates it CVSS 4.0 8.6.

Advisory published October 13, 2026Independent summary
Vendor
Wazuh
Product
Wazuh agent
Identifier / CWE
CVE-2026-74036
CWE-863
Action timing
Immediate
ELI5

Explain it like I’m five

Agents check that a policy file sits in the right folder but not that it was really signed, so the folder becomes the only lock on root commands.

SIMPLIFIED_ATTACK_PATH03 STEPS
  1. 01Policy delivered

    A security configuration assessment policy arrives at the agent from the manager side.

  2. 02Path trusted, signature skipped

    The agent trusts the policy based on its file path without proper authorization of its content.

  3. 03Root commands run

    Commands embedded in the policy execute on the agent as root.

What happened

Wazuh disclosed CVE-2026-74036 for the agent in releases 4.3.0 through those before 4.14.8. SCA policy handling trusts a policy by its file path, which can let a controlling manager run unsigned policy commands as root on agents.

The vendor’s affected data marks 4.14.8 as the first unaffected release, so upgrading to 4.14.8 or later is the stated fix.

What to do

  1. Inventory every Wazuh agent deployment, including test, training, and individually managed instances.
  2. Apply the vendor fix or upgrade exactly as directed in the linked vendor bulletin or advisory.
  3. Restrict network access to Wazuh agent while remediation is underway, especially for internet-facing instances.
  4. Review application and server logs for SCA policy changes outside normal rollouts and agent-side command execution tied to policy application.
  5. Check for accounts, content, or configuration created outside normal change processes, and rotate exposed credentials where access cannot be ruled out.
  6. Verify the deployed version or patch level after remediation.

Management note

If the manager is the thing you are protecting against, agent trust settings are the story. Upgrade agents and managers together to 4.14.8.