CVE-2026-74036 is an improper authorization flaw (CWE-863) in Wazuh. Policy trust is decided by where a file sits on disk, not where it came from, so a manager can have agents run commands as root. The record rates it High at 7.2. Version 4.14.8 fixes it.
What's affected
The record says Wazuh from 4.3.0 before 4.14.8 is affected, and the advisory (GHSA-qmhg-366r-jjfp) lists 4.14.8 as patched.
The flaw concerns the Security Configuration Assessment feature, where policies can contain command checks. The setting sca.remote_commands is off by default and is meant to stop a manager from running arbitrary shell commands on agents. The advisory says the check treats a policy as local and trusted based on its path, so a manager that can place a file outside the shared configuration directory can bypass the setting. No package signing key is needed.
The attacker needs control of a manager, which is why privileges required are high.
Severity, as two sources state it. The record gives 7.2 (High) under CVSS 3.1. VulnCheck lists it at 8.6 (High) under CVSS 4.0. Both are High.
How to check if you're exposed
Find the version on each manager and, where relevant, each agent.
/var/ossec/bin/wazuh-control info
The output includes the version. Packages installed from repositories can also be checked with your package manager, for example rpm -q wazuh-manager or dpkg -l wazuh-manager. Compare with 4.14.8, the fixed version the advisory lists.
Also review who can administer your managers and how agents are told which manager to trust.
What to do now
- Upgrade managers and agents to 4.14.8 or later. Agents run the SCA module, so do not stop at the manager.
- Keep sca.remote_commands at its default of 0 unless you truly need remote command checks.
- Restrict and monitor administrative access to the Wazuh manager, since the attack path begins there.
- Review policy files in the agent's incoming directory for anything you did not deploy.
- Treat manager hosts as high value: patch promptly, segment them and log all changes.
Why it matters
The weakness is improper authorization, CWE-863. The control exists, and it is off by default, but the decision about whether a policy is remote and therefore untrusted was based on its location on disk. The advisory says a manager can write an unsigned policy file to a different directory through the upgrade channel and then reference it, so its command checks run as root on the agent.
Security tooling is a rich target, because it runs with high privileges everywhere. A flaw that lets a central server command its agents makes the manager a single point of compromise for the whole fleet. Trust decisions should rest on provenance such as signatures or configuration source, not on where a file happens to be. KEV status is false.
Quick check
What is sca.remote_commands?
A setting, off by default, that decides whether a manager may run shell commands on agents through SCA policies.
Can an ordinary agent exploit this?
The advisory describes a manager as the attacker. An agent would have to be pointed at a hostile or compromised manager.
Sources
Last reviewed: 18 October 2026.
