CVE WATCH / VULNERABILITY DETAIL
CVE-2026-74036
HIGHCVSS 7.2NVD feed
Published 13 October 2026 · tracked since 14 October 2026
Description
Wazuh from 4.3.0 before 4.14.8 contains a remote code execution vulnerability where SCA policy trust is determined by file path rather than configuration source. Attackers controlling a manager can write unsigned policy files to var/incoming via the upgrade channel and reference them to execute comm
References
- NVD — National Vulnerability Database
- CVE.org record (MITRE)
- CISA Known Exploited Vulnerabilities catalog
Latest tracked vulnerabilities
- CVE-2026-65197 LOW 3.1
- CVE-2026-53418 HIGH 8.1
- CVE-2026-109521 HIGH 7.3
- CVE-2026-109522 HIGH 7.3
- CVE-2026-109523 HIGH 7.3
- CVE-2026-108184 HIGH 7.4
- CVE-2026-106108
- CVE-2026-107460
- CVE-2026-102342 MEDIUM 5.4
- CVE-2026-109960 HIGH 7.7