CVE-2026-74036: Wazuh 4.3.0 before 4.14.8 Remote Code Execution via SCA Command Policies
Wazuh from 4.3.0 before 4.14.8 contains a remote code execution vulnerability where SCA policy trust is determined by file path rather than configuration source. Attackers controlling a manager can write unsigned policy files to var/incoming via the upgrade channel and reference them to execute command checks as root on agents.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Wazuhto a version that resolves this vulnerability.Fixed in 4.14.8
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Wazuh deployments running versions from 4.3.0 before 4.14.8 are affected. Exploitation targets Wazuh agents through a manager that the attacker controls.
What access does an attacker need to exploit it?
The attacker must be able to control a Wazuh manager. They use the upgrade channel to place an unsigned SCA policy in var/incoming and cause an agent to reference that policy.
What is the impact on a successfully exploited agent?
An attacker can execute SCA command checks as root on affected agents. This can result in high-impact compromise of confidentiality, integrity, and availability on those systems.
What version fixes the vulnerability?
Upgrade Wazuh to version 4.14.8 or later.