CVE-2026-74040

Wazuh versions before 4.14.8 allow cluster workers to overwrite protected config files, enabling root remote code execution across the manager and all agents.

An arbitrary file overwrite vulnerability in Wazuh's MasterHandler.process_files_from_worker lets attackers controlling a cluster worker bypass protections and overwrite ossec.conf and agent.conf. This achieves root remote code execution on the manager and every agent, severely compromising the security monitoring infrastructure that DIBs rely on for compliance and threat detection. Organizations must ensure Wazuh is patched to 4.14.8 or later and restrict cluster worker access to prevent exploitation.

Shame score — A critical RCE vulnerability in a widely deployed security monitoring tool that was left unpatched for years, allowing attackers to fully compromise the very systems meant to protect the network.