Threat Intelligence Database

Wazuh from 4.3.0 before 4.14.8 contains a remote code execution vulnerability where SCA policy trust is determined by file path rather than configuration source. Attackers controlling a manager can write unsigned policy files to var/incoming via the upgrade channel and reference them to execute command checks as root on agents.

CVE-2026-74030 is a medium severity vulnerability in Wazuh agent versions 3.9.0 up to but not including 4.14.8. It involves improper restriction of recursive entity references in YAML alias expansion within the yaml2json_node component. A manager-controlled policy can exploit this by pushing nested YAML aliases that cause excessive memory consumption, leading to out-of-memory (OOM) termination of wazuh-modulesd on affected agents.

Wazuh wazuh-agent and wazuh-manager versions 2.1.0 before 4.8.0 contain multiple shell injection and untrusted search path vulnerabilities that allow attackers to execute arbitrary commands through various components including logcollector configuration, maild SMTP server tags, and Kaspersky AR script parameters. Attackers can exploit these vulnerabilities by injecting malicious commands through configuration files, SMTP server settings, and custom flags to achieve remote code execution on affected systems.