Is CVE-2026-74041 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-74041 being exploited in the wild.

How severe is CVE-2026-74041?

Critical severity, with a CVSS score of 9.1, published 13 October 2026.

Which products and versions are affected?

Wazuh Manager 4.14.3 through 4.14.7.

Is there a fix for CVE-2026-74041?

Yes: fixed in 4.14.8. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-74041 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-74041?

Check whether you run Wazuh Manager at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-74041: Wazuh case-sensitivity mismatch in remote-command validation

CVE-2026-74041 · Severity: critical · CVSS 9.1 · Published 2026-10-13

Wazuh is a security monitoring platform that analyzes logs and detects threats on manager systems. A configuration validation flaw allows authenticated users with config-update permissions to execute arbitrary commands as root on the Wazuh manager by uploading a specially crafted configuration file. The vulnerability exploits a case-sensitivity mismatch where the validator rejects lowercase command configurations but accepts uppercase ones, which the log collector then executes with root privileges.

Technologies: Wazuh Manager. Vendors: Wazuh.

Quick answers

Is CVE-2026-74041 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-74041 being exploited in the wild.
How severe is CVE-2026-74041?: Critical severity, with a CVSS score of 9.1, published 13 October 2026.
Which products and versions are affected?: Wazuh Manager 4.14.3 through 4.14.7.
Is there a fix for CVE-2026-74041?: Yes: fixed in 4.14.8. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-74041 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-74041?: Check whether you run Wazuh Manager at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 4.14.8

Technical details

A case-sensitivity mismatch between the ossec.conf validator (check_remote_commands in Python, which performs case-sensitive tag matching) and wazuh-logcollector (which uses strcasecmp for case-insensitive tag matching) allows an attacker to bypass command-execution restrictions. An authenticated user with manager:update_config permission can inject an uppercase <LOG_FORMAT>full_command</LOG_FORMAT> element (paired with a decoy lowercase <log_format> element) that passes validation but is executed as root by the collector on config reload. The vulnerability is reachable via the REST API (PUT /manager/configuration) without requiring cluster credentials.

Affected products

Wazuh Wazuh Manager 4.14.3 through 4.14.7

Timeline

2026-10-13: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.