9.4 Critical Wazuh Flaw Lets Workers Overwrite Configs for Root Access

A security flaw in Wazuh allows attackers who control a cluster worker to take complete root control of the entire security management system by overwriting critical configuration files. This represents a severe escalation in risk for organizations relying on the platform for endpoint detection and response capabilities.

The risk

The vulnerability, identified as CVE-2026-74040, carries a CVSS score of 9.4, which classifies it as critical according to the National Vulnerability Database records. It stems from an arbitrary file overwrite issue within the MasterHandler.process_files_from_worker component. This function is responsible for handling file transfers from worker nodes to the central manager in a Wazuh cluster environment.

Attackers who have already compromised a worker node can exploit this weakness to bypass security checks. By using a trailing-slash basename bypass and exploiting missing extra_valid enforcement, they can overwrite protected master files. This allows them to replace essential configuration files, specifically ossec.conf and agent.conf, with malicious versions of their choosing.

Who is exposed

The flaw affects Wazuh manager versions starting from 3.9.0 up to, but not including, version 4.14.8. Any deployment running these affected versions is potentially vulnerable if an attacker can gain initial access to a worker node within the cluster. The impact extends beyond the single compromised worker because the overwrite affects the central manager's configuration.

Once the configuration files are overwritten, the attacker achieves root-level remote code execution. This compromise is not limited to the manager node itself; the malicious configuration propagates to every agent connected to the manager. This means the entire security monitoring infrastructure controlled by that manager falls under the attacker's command.

Cost and compliance

The source material does not provide specific details regarding financial costs, regulatory fines, or compliance penalties associated with this vulnerability. The National Vulnerability Database record focuses exclusively on the technical classification, CVSS score, and the nature of the arbitrary file overwrite weakness. No information is provided about real-world exploitation costs or incident response expenses.

What should you do?

Teams managing Wazuh clusters should immediately verify the version of their manager nodes to determine if they fall within the affected range of 3.9.0 to 4.14.7. If the software is affected, administrators should prioritize updating to version 4.14.8 or later to close the vulnerability. Until an update is applied, monitoring for unusual file changes on the manager is advisable.

The background in plain language

In a clustered security system, worker nodes collect data and send it to a central manager. The manager trusts these workers to send valid files. A configuration file is a text document that tells the software how to behave. If an attacker can trick the manager into accepting a fake configuration file from a compromised worker, they can change how the entire system operates. This usually allows them to execute commands with the highest level of privilege, effectively taking over the system. Teams usually separate duties to prevent one compromised part from controlling the whole system.

Background: Remote code execution vulnerabilities

Small businesses face high remote code execution risks due to limited patching resources and complex dependencies. You can mitigate this by enforcing strict input validation, maintaining an accurate IT asset inventory, and requiring vendors to demonstrate automated security regression testing for all updates.

Read the full guide: Remote Code Execution Risks and Protection for Small Businesses

What to do and how to stay safe: Wazuh

• Verify the current version of all Wazuh manager nodes against the affected range of 3.9.0 to 4.14.7.
• Apply the vendor update to version 4.14.8 or newer as soon as it becomes available to your environment.
• Monitor manager logs for unexpected file modifications or unauthorized configuration changes during the interim period.
• Review access controls for cluster worker nodes to ensure no unauthorized entities have gained entry.

Step-by-step guide: Zero-Day Vulnerabilities Meaning: How Unpatched Flaws Bypass Your Defenses

General security guidance from the Vector Tribune newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which Wazuh versions are affected by CVE-2026-74040?

Wazuh versions from 3.9.0 up to 4.14.7 are affected by this vulnerability.

What is the severity rating of this flaw?

The vulnerability has a CVSS score of 9.4, which is rated as critical.

Can an attacker control the agents through this flaw?

Yes, by overwriting the manager's configuration, the attacker can achieve root code execution across every agent connected to the manager.