CVE-2026-74041
CVSS 9.1 CRITICAL: wazuh 4.14.3 before 4.14.8 contains a case-sensitivity mismatch between the ossec.conf validator and wazuh-logcollector that bypasses remote-command validation.
Vulnerabilities · 6h ago
INCIBE-CERT says Wazuh Manager 4.14.3 through 4.14.7 have CVE-2026-74041, a case-sensitivity mismatch that can let an authenticated user with manager:update_config run commands as root on the manager. Version 4.14.8 fixes it.
The flaw is a disagreement between the ossec.conf validator and wazuh-logcollector: one checks the setting one way, while the runtime component accepts the same value written in uppercase. That means a crafted LOG_FORMAT entry can pass validation, then turn into a remote command when the service reloads.
For teams that delegated config changes to operators or integrations, the risky boundary is the manager itself, not just the config file. If a user can edit that setting, the permission can cross into host-level execution until the fixed version is in place.
CVSS 9.1 CRITICAL: wazuh 4.14.3 before 4.14.8 contains a case-sensitivity mismatch between the ossec.conf validator and wazuh-logcollector that bypasses remote-command validation.
1 source covering this story
Gestión incorrecta de mayúsculas y minúsculas en Wazuh Manager
namd0ng y vikman90 han informado sobre una vulnerabilidad de severidad crítica que, en caso de ser exp
Part of the PlainSec briefing for 2026-10-16