Is CVE-2026-74037 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-74037 being exploited in the wild.

How severe is CVE-2026-74037?

High severity, with a CVSS score of 7.2, published 13 October 2026.

Is there a fix for CVE-2026-74037?

Yes: fixed in 4.14.8. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-74037 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-74037?

Check whether you run Wazuh Manager at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-74037: Wazuh token invalidation bypass in run_as users

CVE-2026-74037 · Severity: high · CVSS 7.2 · Published 2026-10-13

Wazuh's security API fails to revoke authentication tokens for users granted temporary administrator privileges through single sign-on (SSO) authentication contexts. An attacker with a revoked administrator grant can continue using their stale token to make API calls with full administrative privileges, and can permanently assign the administrator role to their own account to maintain access even after the temporary grant expires.

Technologies: Wazuh Manager. Vendors: Wazuh.

Quick answers

Is CVE-2026-74037 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-74037 being exploited in the wild.
How severe is CVE-2026-74037?: High severity, with a CVSS score of 7.2, published 13 October 2026.
Which products and versions are affected?: Wazuh Manager 4.0.0 to 4.14.7.
Is there a fix for CVE-2026-74037?: Yes: fixed in 4.14.8. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-74037 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-74037?: Check whether you run Wazuh Manager at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 4.14.8

Technical details

The check_token function in api/api/authentication.py consults the token blacklist only within a per-role loop that never executes for SSO/run_as users with zero static roles. For such users, the validity check is bypassed entirely and the function unconditionally returns valid: True regardless of revocation status. An attacker who was granted a dynamic role via authorization-context rules can retain a valid token after that rule is deleted, and use it to self-assign the administrator role permanently.

Affected products

Wazuh Wazuh Manager 4.0.0 to 4.14.7

Timeline

2026-10-13: disclosed
2026-09-25: patched: v4.14.8 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.