External risk intelligence

Wazuh Arbitrary File Overwrite to Root RCE

CVE advisorySeverity: CRITICAL (CVSS 9.4)

CVE-2026-74040

The vulnerability exists within the cluster communication mechanism between a Wazuh manager and its workers. While these components use network connectivity, they are typically deployed within isolated internal management segments or secure private networks, not directly exposed to the public internet. Access is generally restricted to authorized infrastructure components.

Remote Code Execution

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory describes a critical vulnerability in Wazuh's file processing that, if exploited, could allow an attacker to overwrite critical system files and gain unauthorized control over the manager and connected agents. The main concern is confirming if our environment utilizes the affected Wazuh versions and is potentially exposed.

Unauthorized control of systems is possible.
This affects core security monitoring infrastructure.
Confirm relevance and exposure immediately.

Attack Path

How an attacker could exploit the issue

An attacker with control over a Wazuh cluster worker could exploit this vulnerability by overwriting critical configuration files on the master node. This is made possible by a bypass in how filenames are processed and a lack of proper validation. Successfully overwriting these files could allow an attacker to achieve root-level code execution on the master and all connected agents.

Requires control over a cluster worker.
Overwrites master configuration files.
Root code execution on manager and agents.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, a malicious cluster worker could overwrite critical configuration files on the Wazuh manager, potentially leading to system compromise. This could then propagate to all connected agents.

Protected manager files.
Worker overwrites master configuration.
Root remote code execution.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in Wazuh's MasterHandler is critical for teams managing Wazuh deployments. The first practical step is to identify all Wazuh manager and agent instances, confirm their network reachability and business criticality, and then coordinate with the platform or infrastructure team responsible for the Wazuh deployment to plan and execute remediation.

Wazuh platform/infrastructure team owns.

-Verify manager and agent network exposure. -Plan and execute secure upgrade.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Wazuh?

Wazuh is an open-source security platform used for threat detection, integrity monitoring, and incident response. It operates using a manager-worker architecture, where a central manager coordinates security data from multiple agents and workers across an organization's infrastructure to provide centralized monitoring and compliance enforcement.

How does CVE-2026-74040 lead to code execution?

This vulnerability, classified as CWE-862 (Missing Authorization), occurs when the master component fails to properly validate files sent by a worker. By exploiting this, an attacker can overwrite restricted configuration files, such as ossec.conf. Because these files control system behavior, overwriting them allows an attacker to inject commands and gain root-level access across the cluster.

Can any user trigger this vulnerability?

No. The flaw specifically requires the attacker to already have control over a Wazuh cluster worker node. It is not triggered by standard network traffic, general agent communications, or unauthorized users outside the management cluster. The vulnerability relies on abusing the specific file-processing logic within the existing communication path between the worker and the master.

Is my Wazuh deployment at high risk?

According to Halo Surface Signal, this vulnerability is considered unlikely to be reachable from the public internet. Because the flaw exists within the internal cluster communication mechanism, it typically impacts systems confined to private, internal management networks rather than public-facing services. You should assess if your workers are accessible to untrusted entities.

What should I do to secure my Wazuh installation?

First, inventory your environment to identify all Wazuh manager and worker instances currently running versions prior to 4.14.8. Once identified, prioritize these systems based on their internal network placement and coordinate with your infrastructure team to plan a controlled upgrade to version 4.14.8 or newer to resolve the file validation deficiency.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.