CVE-2026-74041

Summary

A case-sensitivity bug in Wazuh's configuration validation allows authenticated users with manager:update_config privileges to inject uppercase LOG_FORMAT commands that bypass validation and execute as root during log collector reload. This creates a privilege escalation vector where attackers can run arbitrary commands with root privileges.

Exploitability

Exploitation requires an authenticated user with manager:update_config permissions, which is moderately difficult but achievable in environments where users have administrative access, and the attack must be timed around configuration reloads.

Blast radius

The impact is critical as attackers can execute arbitrary commands as root on any Wazuh manager node, potentially leading to full system compromise and lateral movement across the monitored infrastructure.

Detection

Monitor for unusual configuration changes in ossec.conf that include uppercase LOG_FORMAT directives, particularly when followed by immediate log collector restarts or reloads, and look for root process execution patterns during configuration updates.

Prioritized remediation

Upgrade to Wazuh 4.14.8 or later to fix the case-sensitivity mismatch in configuration validation.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.