CVE-2026-74040 affects Wazuh, the open-source SIEM/XDR platform many teams deploy precisely to catch compromises. Rated 9.1, published by NVD on October 13, 2026: in a cluster, a compromised worker node can overwrite protected files on the master and turn that into root code execution on the manager and on every agent.
| Field | Value |
|---|---|
| CVSS 3.1 | 9.1 (CRITICAL) |
| Vector | AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H |
| NVD published | 2026-10-13 |
| Versions | 3.9.0 up to, but not including, 4.14.8 |
| CISA KEV | no (as of writing) |
What the Flaw Does
Wazuh versions from 3.9.0 before 4.14.8 contain an arbitrary file overwrite vulnerability [...] allowing a cluster worker to overwrite protected master files.
In a Wazuh cluster, workers sync files with the master. The master is supposed to accept only a limited set of files from them. This flaw bypasses that filtering: a worker can get the master to write files it has no business touching, including the manager configuration and the centralized agent configuration.
The rest follows. The master pushes centralized configuration to every agent in the fleet. Control its content and you control what each agent runs — with the root privileges agents hold on their hosts.
Why It Matters: the Security Tool as the Attack Path
PR:H lowers the score: you need to control a worker first. Don't lean on that too much. S:C is the real story: the compromise escapes the worker, reaches the master, then everything the master drives.
A security agent is, by design:
- installed everywhere — servers, workstations, sometimes domain controllers
- running as root or SYSTEM
- remotely controlled by a central server whose instructions are trusted
That's the exact profile of a malware distribution tool. An attacker who lands on a single worker — often a less-watched node, exposed to collect agents from a remote site — can turn the SIEM into a delivery channel for the whole estate. And the traffic looks like routine administration.
There's a side effect too: the tool meant to warn you is the one that's compromised. A tampered configuration can also silence alerting.
Versions
The NVD description is explicit: 3.9.0 up to, but not including, 4.14.8. The fixed release is 4.14.8. NVD doesn't yet expose a detailed CPE configuration; check the Wazuh advisory for your branch.
Only clustered deployments (master + workers) are exposed to this scenario. A standalone manager has no worker to compromise — but the update still applies.
Detection
- Changes to the manager configuration (
ossec.conf) and the centralized agent configuration (agent.conf) on the master with no documented change - Unexpected content in centralized configuration: commands, modules or scripts your team didn't add
- Unusual child processes of the Wazuh agent on hosts
- Abnormal activity on workers: admin logins, new accounts, files modified outside updates
- Cluster sync traffic from an address that isn't a known worker
Mitigation
- Upgrade to 4.14.8 on every cluster node, master and workers.
- Isolate the cluster channel: the master–worker sync port should only be reachable from cluster nodes, not from the agent network or the internet.
- Harden workers like the master: same monitoring, same access restrictions. A worker is a way into the master.
- Monitor integrity of the master's configuration files from a tool independent of Wazuh.
- If in doubt: review the centralized configuration pushed to agents, diff it against a known-good copy, and treat every host running an agent as potentially exposed.
Why Monitor Your Security Tooling
Few teams track the versions of the tool that does the tracking. Yet a SIEM with root agents across the estate is one of the most privileged assets you run, and a CVE like this turns it into a propagation path.
With cveo.tech, inventory your security tooling with exact versions, and get alerted whenever a critical CVE affects it.