Is CVE-2026-74030 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-74030 being exploited in the wild.

How severe is CVE-2026-74030?

Medium severity, with a CVSS score of 4.9, published 13 October 2026.

Which products and versions are affected?

Wazuh Agent 3.9.0 to 4.14.7; Wazuh Manager 3.9.0 to 4.14.7.

Is there a fix for CVE-2026-74030?

Yes: fixed in 4.14.8. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-74030 attacked?

It is attacked over the network.

Am I affected by CVE-2026-74030?

Check whether you run Wazuh Agent or Wazuh Manager at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-74030: Wazuh YAML alias expansion memory exhaustion in SCA

CVE-2026-74030 · Severity: medium · CVSS 4.9 · Published 2026-10-13

Wazuh is an open-source security monitoring platform used for threat detection and incident response. A vulnerability in how it parses Security Configuration Assessment (SCA) policy files allows an attacker who controls the Wazuh manager to crash agent processes through memory exhaustion via crafted YAML files—a so-called "billion laughs" attack. An attacker can disable security monitoring on all agents in a targeted group by pushing a malicious ~1 KB policy file.

Technologies: Wazuh Agent, Wazuh Manager. Vendors: Wazuh.

Quick answers

Is CVE-2026-74030 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-74030 being exploited in the wild.
How severe is CVE-2026-74030?: Medium severity, with a CVSS score of 4.9, published 13 October 2026.
Which products and versions are affected?: Wazuh Agent 3.9.0 to 4.14.7; Wazuh Manager 3.9.0 to 4.14.7.
Is there a fix for CVE-2026-74030?: Yes: fixed in 4.14.8. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-74030 attacked?: It is attacked over the network.
Am I affected by CVE-2026-74030?: Check whether you run Wazuh Agent or Wazuh Manager at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 4.14.8

Technical details

The yaml2json_node function in yaml2json.c recursively expands YAML aliases without bounds on expansion depth, recursion depth, or output size. A manager-controlled YAML file with nested aliases (the "billion laughs" pattern) can expand a 573-byte input to 23.4 million logical node visits and 1 GiB resident memory, causing an out-of-memory kill of wazuh-modulesd. The vulnerability is reachable before any agent-side SCA rule evaluation or remote command restriction checks, affecting all agents receiving the malicious policy via manager-to-agent push.

Affected products

Wazuh Wazuh Agent 3.9.0 to 4.14.7
Wazuh Wazuh Manager 3.9.0 to 4.14.7

Timeline

2026-10-13: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.