CVE-2026-74034

{
  "etk_id": "ETK-2026-1473",
  "cve_id": "CVE-2026-74034",
  "display_id": "CVE-2026-74034",
  "ghsa_id": "GHSA-r7hm-43xr-477j",
  "euvd_id": "EUVD-2026-98672",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Missing origin validation in Wazuh manager upgrade handling",
  "summary": "Wazuh wazuh-manager versions 4.1.0 through 4.14.7 do not adequately validate the origin of certain agent upgrade requests. An attacker controlling an enrolled agent may cause the manager to read files with root privileges, potentially exposing sensitive system and Wazuh credentials.",
  "mitigation": "Upgrade wazuh-manager to version 4.14.8 or later. Until upgraded, restrict enrollment and access to the agent communication channel to trusted agents and networks.",
  "vendor": "Wazuh",
  "product": "wazuh-manager",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 4.1.0"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "4.14.8"
      ],
      "package_name": "wazuh-manager",
      "purl": null
    }
  ],
  "cwes": [
    862
  ],
  "cvss_score": 8.7,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
  "epss_score": 0.0034,
  "epss_percentile": 0.2621,
  "epss_asof": "2026-10-20",
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 54.734771466666665,
  "t0_at": "2026-10-13T13:27:28.086000+00:00",
  "signals": {
    "public_poc": {
      "at": "2026-10-14T14:07:23+00:00",
      "days": 1.0277189120370371,
      "is_lower_bound": false,
      "measured_at": "2026-10-13T13:27:28.086000+00:00",
      "url": "https://github.com/roninreilly/wazuh-unauth-chain"
    },
    "trigger_signal": {
      "at": "2026-10-13T13:27:28.086000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-13T13:27:28.086000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74034"
    }
  }
}