The boundary between data and code is one of the oldest themes in vulnerability research, and CVE-2026-74041 is a compact example of it. In Wazuh Manager 4.14.3 to 4.14.7, a configuration directive carrying command semantics crosses from text into execution without the validation that was supposed to guard the transition.

INCIBE-CERT documented the issue in advisory INCIBE-2026-753 on 16 October 2026, rated it critical, and credited namd0ng and vikman90. The gating permission is manager:update_config; the outcome on reload is root command execution.

The transition point

ossec.conf holds directives that influence how logs are collected and processed. LOG_FORMAT is one of them, and it can express behaviour equivalent to running a command. A validator inspects the file to block remote command execution. wazuh-logcollector performs the interpretation.

The two disagree about case. Written in upper case, the directive reaches the collector without the validator applying its command filter. The reload then turns the text into a process running as root.

Configuration-to-code transitions are risky wherever they occur, because the artifact is reviewed, diffed and stored as inert text by everyone who handles it before the interpreter sees it. Reviewers read meaning; parsers read bytes. Where those two readings diverge, the difference is the attack surface.

Exploitation prerequisites

An authenticated account with manager:update_config and a reload of the manager service. Both are ordinary in a functioning deployment, which is why the severity is critical despite the absence of an unauthenticated path. The advisory records no exploitation in the wild as of publication.

Impact

Wazuh Manager coordinates agents, rules and alerts. Root access on the manager places the collected security record and the behaviour of the agent fleet in question. The advisory documents the root execution itself; downstream scenarios are consequences of the mechanism rather than reported incidents.

Affected versions and mitigation

Wazuh Manager from 4.14.3 inclusive to less than 4.14.8. Upgrade to 4.14.8 or later to remove the flaw.

Interim measures: treat manager:update_config as root-equivalent, restrict it, and review ossec.conf for LOG_FORMAT directives with unusual casing while watching reload events against change records. These reduce exposure without changing the shipped parser behaviour.

Exposure numbers in context

A ZoomEye search for app="Wazuh" matched 18031 assets and vul.cve="CVE-2026-74041" matched zero when checked on 2026-10-22. The product count measures fingerprinted services, not vulnerable ones; the CVE count measures indexed tagging, not absence of risk.

Search link: https://www.zoomeye.ai/searchResult?q=YXBwPSJXYXp1aCI%3D

Sources

  • INCIBE-CERT advisory INCIBE-2026-753: https://www.incibe.es/incibe-cert/alerta-temprana/avisos/gestion-incorrecta-de-mayusculas-y-minusculas-en-wazuh-manager

  • ZoomEye observations, 2026-10-22: app="Wazuh" = 18031; vul.cve="CVE-2026-74041" = 0.