high7.5
CVE-2026-74034
Wazuh from 4.1.0 before 4.14.8 contains a missing origin check in wm_agent_upgrade that allows enrolled agents to issue upgrade_custom commands with attacker-c…
Impact
Wazuh from 4.1.0 before 4.14.8 contains a missing origin check in wm_agent_upgrade that allows enrolled agents to issue upgrade_custom commands with attacker-controlled file_path. Attackers can inject an upgrade_custom message over the agent channel to read arbitrary files as root, exfiltrating /etc/shadow and client.keys.
Affected products
| Product | Affected versions |
|---|---|
| Wazuh From 4.1.0 | before 4.14.8 |
Versions were read from the advisory text. No structured product data has been published for this record yet.