CVE-2026-74036

Executive Summary

CVE-2026-74036 is a remote code execution vulnerability in Wazuh (versions 4.3.0 through 4.14.7) in which SCA (Security Configuration Assessment) policy trust is established by file path rather than by configuration source. An attacker who controls a Wazuh manager can write unsigned policy files into the var/incoming directory via the upgrade channel and reference those files so that their command checks execute as root on connected agents. The vulnerability carries a CVSS v3.1 base score of 7.2 (High), reflecting high impact to confidentiality, integrity, and availability, limited by a high privilege prerequisite on the manager.

Technical Analysis

Wazuh is an open-source security platform composed of a manager (server) and distributed agents. The Security Configuration Assessment (SCA) subsystem evaluates agent endpoints against policy definitions and can run command checks as part of that evaluation. According to the NVD description, the core defect (CWE-863, Incorrect Authorization) is that SCA policy trust is determined by the file path of a policy rather than by its configuration source. This means the platform treats any policy file appearing at the trusted location as legitimate, without verifying its origin, signature, or the configuration channel through which it was delivered.

The attack surface centers on two manager-side mechanisms:

1. The upgrade channel, which is a legitimate agent-management feature used to distribute modules and updates. The description states that attackers controlling a manager can write unsigned policy files to var/incoming through this channel.
2. The SCA policy reference mechanism, which causes agents to load policies and, critically, to execute their embedded command checks as root.

Because trust is bound to the path and not the source, a policy placed in var/incoming and then referenced by an agent is accepted and executed. The command checks — designed to gather host state for configuration assessment — run under root privileges on the agent. When an attacker supplies an attacker-authored policy, those command checks become arbitrary root-level command execution.

Two important trust boundaries are violated:

• Manager-to-agent integrity: Agents are designed to receive configuration from an authoritative manager, but the content of SCA policies was not authenticated independently of the delivery path. An attacker who compromises or impersonates the manager role gains code execution on every agent that consumes the malicious policy.
• Privilege boundary: SCA command checks are intentionally powerful (root) because they must inspect the host. The vulnerability converts that intended power into an attacker-controlled execution primitive.

The CVSS vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) confirms the network-reachable nature of the flaw, a high privilege requirement (control of the manager), and full compromise of confidentiality, integrity, and availability on the affected agent scope, without a scope change (S:U) — the impact remains within the agents' security authority.

Notably, no vendor fix version, workaround, or patch reference is available from tracked sources. The stated vulnerable range is "from 4.3.0 before 4.14.8," implying 4.14.8 may be the first fixed release; however, this is not corroborated by any patch source, and patch confidence is 0/4. No public PoC or exploit code has been observed, and the EPSS score is not yet assigned.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred strictly from the vulnerability class (CWE-863, incorrect authorization based on path rather than source) and the mechanism described in the NVD entry.

1. Reconnaissance and target identification. The attacker identifies Wazuh deployments where they can obtain or already hold control of a manager — the prerequisite for this attack. Wazuh managers expose management and API surfaces; internet-exposed managers (e.g., the API service commonly on port 55000, and agent enrollment/communication ports) are the primary discovery targets via Shodan dorks such as product:"Wazuh" and port:55000. The attacker maps the agent fleet managed by the compromised manager to understand blast radius.

2. Triggering the flaw class (improper authorization on policy source). Having established manager-side control, the attacker abuses the upgrade channel — a legitimate, trusted distribution path — to place an unsigned SCA policy file into the var/incoming directory. Because SCA policy trust is derived from the file path and not the configuration source, the platform does not validate that the policy originated from an authorized configuration source or that it is signed. The attacker-authored policy is therefore treated as legitimate once it resides at the expected location.

3. Payload / execution method at the vulnerability-class level. The attacker references the malicious policy so that agents load it. SCA policies contain command checks, and the description explicitly states these execute as root on agents. The attacker-controlled policy's command checks thus become the execution vector: arbitrary commands supplied by the attacker run with root privileges on each affected agent. No specific function names, API paths, or parameter names are disclosed in the source data, so the exact invocation syntax is not asserted here.

4. Post-exploitation impact. Because command checks run as root, successful exploitation yields full root-level code execution on every agent that consumes the malicious policy. From there, an attacker can persist, disable or tamper with security controls, exfiltrate data, pivot laterally into agent-hosted networks, or sabotage the fleet. Since the same manager typically governs many agents, a single compromised manager can translate into fleet-wide compromise — a classic supply-chain-style amplification (T1195).

Impact Assessment

The CVSS v3.1 base score is 7.2 (High) with vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H.

• Confidentiality (C:H): Root-level execution on agents exposes all host data the agents can access, including credentials, configuration, and monitored application data.
• Integrity (I:H): Attackers can modify files, security configuration, and agent behavior at the highest privilege level, and can alter the very SCA results the platform is meant to produce.
• Availability (A:H): Root access permits service disruption, resource exhaustion, or destructive actions across the agent fleet.
• Attack Vector (AV:N) / Complexity (AC:L): Reachable over the network with low exploitation complexity once prerequisites are met.
• Privileges Required (PR:H): The attacker must first control the Wazuh manager — a significant gate that limits opportunistic mass exploitation but is realistic for targeted, insider, or supply-chain-adjacent attacks.
• Scope (S:U): Impact is scored as remaining within the same security authority, though operationally it spans every agent under the compromised manager.

Blast radius: Any organization running Wazuh 4.3.0 through 4.14.7 with agents consuming SCA policies from a manager. A single manager compromise can propagate malicious policy to the entire managed fleet, making the effective blast radius the union of all managed endpoints. Because Wazuh is often deployed as a security monitoring backbone, compromise of its agents can blind or subvert an organization's detection capability at scale.

Business impact: Fleet-wide root compromise of security agents undermines endpoint monitoring, compliance (SCA is used for compliance evidence), and incident response. Regulated environments relying on Wazuh for continuous monitoring face compliance and evidentiary risk.

Detection Guidance

Sigma Rule

title: Wazuh SCA Malicious Policy Written via Upgrade Channel (CVE-2026-74036)
id: 7a3c1f92-4e6b-4d2a-9c11-wazuhsca74036
status: experimental
description: Detects creation or modification of SCA policy files in the Wazuh var/incoming directory, consistent with CVE-2026-74036 unsigned policy injection via the upgrade channel.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-74036
author: valtersit.com
date: 2026/01/01
logsource:
  product: linux
  category: file_event
detection:
  selection_path:
    TargetFilename|contains: 'var/incoming'
  selection_ext:
    TargetFilename|endswith:
      - '.yml'
      - '.yaml'
      - '.xml'
  condition: selection_path and selection_ext
falsepositives:
  - Legitimate Wazuh module upgrades during maintenance windows
level: high

YARA Rule

rule CVE_2026_74036_Wazuh_SCA_Malicious_Policy
{
    meta:
        description = "Detects SCA policy files potentially injected via the Wazuh upgrade channel (CVE-2026-74036)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-74036"
        date = "2026-01-01"
        severity = "high"

    strings:
        $sca1 = "sca" ascii nocase
        $sca2 = "policy" ascii nocase
        $chk1 = "command" ascii nocase
        $chk2 = "check" ascii nocase
        $path = "var/incoming" ascii nocase
        $sh1 = "/bin/sh" ascii
        $sh2 = "/bin/bash" ascii
        $b64 = "base64" ascii nocase
        $curl = "curl" ascii nocase
        $wget = "wget" ascii nocase

    condition:
        (uint32(0) == 0x04034b50 or filesize < 2MB) and
        ($sca1 or $sca2) and ($chk1 or $chk2) and
        (any of ($sh*) or any of ($curl, $wget, $b64) or $path)
}

Suricata IDS Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-74036 Wazuh SCA Policy Exfiltration/Injection Indicator"; flow:established,to_server; content:"var/incoming"; http_uri; nocase; content:"policy"; nocase; distance:0; classtype:attempted-admin; sid:7403601; rev:1; metadata:created_at 2026_01_01, cve CVE-2026-74036;)

Elastic Detection

file where event.category == "file" and event.action in ("creation", "modification")
  and file.path : "*/var/incoming/*"
  and (file.extension in ("yml", "yaml", "xml"))

Splunk SPL Query

index=wazuh OR index=ossec (sourcetype=wazuh OR sourcetype=ossec)
| search ("var/incoming" OR "sca" OR "policy")
| search (command=* OR check=*)
| stats count min(_time) as first_seen max(_time) as last_seen
        values(command) as commands values(file) as files by host, user, rule_id
| where count > 0
| convert ctime(first_seen) ctime(last_seen)

Wazuh OSSEC Rule

<group name="wazuh,sca,cve-2026-74036,">
  <rule id="740360" level="12">
    <decoded_as>json</decoded_as>
    <field name="file">var/incoming</field>
    <description>CVE-2026-74036: Possible unsigned SCA policy file written to var/incoming via upgrade channel</description>
    <mitre>
      <id>T1195</id>
      <id>T1059</id>
    </mitre>
    <group>sca_policy_injection,</group>
  </rule>

  <rule id="740361" level="14">
    <if_sid>740360</if_sid>
    <field name="command">\.+</field>
    <description>CVE-2026-74036: SCA policy command check executing as root - potential remote code execution</description>
    <mitre>
      <id>T1059</id>
    </mitre>
    <group>rce,sca_policy_injection,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix version, workaround, or patch reference is available. The vulnerable range is reported as 4.3.0 through versions before 4.14.8, but no confirmed fixed release has been verified.

1) Immediate mitigations

• Restrict and harden the Wazuh manager: enforce strong authentication and least privilege on any account or interface that can write to the upgrade channel or the manager's file system. The attack requires manager control (PR:H), so protecting the manager is the primary control.
• Reduce external exposure: do not expose the Wazuh management/API surfaces to untrusted networks. Apply network segmentation and firewall rules limiting access to known administrative hosts.
• Monitor and constrain the var/incoming directory: restrict filesystem write permissions so that only tightly controlled, authenticated processes can place files there, and alert on any new .yml, .yaml, or .xml policy files appearing.
• Review SCA policies currently referenced by agents and validate their origin against expected, authorized configuration sources; remove any unsigned or unrecognized policies.
• Apply file integrity monitoring to var/incoming and SCA policy directories across all managers.

2) Patch / upgrade steps

• No patch is currently available from tracked sources. Monitor the Wazuh project's official release channels and security advisories for a fixed version (the vulnerable range suggests a fix may land in 4.14.8 or later, but this is unconfirmed).
• Until a fix is published, treat all managers as untrusted-write targets and apply the mitigations above. Establish a change control process to validate and test any vendor patch before fleet rollout.

3) Long-term hardening

• Enforce cryptographic signing/verification of SCA policies and upgrade-channel artifacts so that trust derives from origin and signature rather than file path — the root cause of CWE-863 here.
• Adopt zero-trust principles between manager and agents: authenticate every policy and configuration artifact independently of its delivery channel.
• Segment manager and agent tiers, limit lateral movement, and require multi-party approval for manager-level configuration changes.
• Continuously audit agent privilege: SCA command checks running as root should be a controlled, logged, and reviewed capability.
• Track CVE-2026-74036 and Wazuh advisories; integrate vulnerability data feeds and re-evaluate risk once EPSS scoring and any vendor patch are published.

References

• NVD — CVE-2026-74036: https://nvd.nist.gov/vuln/detail/CVE-2026-74036
• MITRE CWE-863 — Incorrect Authorization: https://cwe.mitre.org/data/definitions/863.html
• Wazuh official security advisories and release notes: https://wazuh.com/ (monitor for 4.14.8+ and security bulletins)
• FIRST EPSS (score not yet assigned at time of writing): https://www.first.org/epss/
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-74036 not listed at time of writing): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No threat actor campaigns or exploit-in-the-wild evidence have been identified for CVE-2026-74036. No public PoC, Nuclei template, or exploit code is currently available.