high7.2
CVE-2026-74041
Wazuh 4.14.3 before 4.14.8 and 4.10.4 contains a case-sensitivity mismatch between the ossec.conf validator and wazuh-logcollector that bypasses remote-command…
Impact
Wazuh 4.14.3 before 4.14.8 and 4.10.4 contains a case-sensitivity mismatch between the ossec.conf validator and wazuh-logcollector that bypasses remote-command validation. Authenticated users with manager:update_config can inject an uppercase LOG_FORMAT command localfile that the collector runs as root on reload.
Affected products
| Product | Affected versions |
|---|---|
| Wazuh 4.14.3 | before 4.14.8 |
Versions were read from the advisory text. No structured product data has been published for this record yet.