CVE-2026-74034
Wazuh from 4.1.0 before 4.14.8 contains a missing origin check in wm_agent_upgrade that allows…
- Risk score
- 55/100
- CVSS
- 7.5 v3.1
- Exploit chance (30 days)
- 0.3%
- Published
- 13 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Wazuh from 4.1.0 before 4.14.8 contains a missing origin check in wm_agent_upgrade that allows enrolled agents to issue upgrade_custom commands with attacker-controlled file_path. Attackers can inject an upgrade_custom message over the agent channel to read arbitrary files as root, exfiltrating /etc/shadow and client.…
- Affected
- See advisory
- Fix
- Upgrade the product to 4.14.8 or later.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 7.5 high
- Remotely exploitable without logging in
References
- https://github.com/wazuh/wazuh/releases/tag/v4.14.8
- https://github.com/wazuh/wazuh/security/advisories/GHSA-r7hm-43xr-477j
- https://www.vulncheck.com/advisories/wazuh-4.1.0-before-4.14.8-arbitrary-file-read-via-upgrade-custom-command
- https://github.com/wazuh/wazuh/security/advisories/GHSA-r7hm-43xr-477j
Original description
Wazuh from 4.1.0 before 4.14.8 contains a missing origin check in wm_agent_upgrade that allows enrolled agents to issue upgrade_custom commands with attacker-controlled file_path. Attackers can inject an upgrade_custom message over the agent channel to read arbitrary files as root, exfiltrating /etc/shadow and client.keys.
Last activity 13 Oct 2026. Patch Forecast updates every hour.