Security1 hOctober 25, 2026, 05:40

Critical CVE-2026-74041 in Wazuh Manager fixed in 4.14.8

Wazuh Manager 4.14.3 through 4.14.7 contains a critical flaw, CVE-2026-74041: a user with manager:update_config can reach root command execution via a case-sensitivity mismatch between the ossec.conf validator and wazuh-logcollector. The fix ships in 4.14.8; INCIBE-CERT published advisory INCIBE-2026-753 on 16 October 2026.

DEV Community

Open source

Affected: Wazuh Manager 4.14.3 through 4.14.7 inclusive
Exploitation needs manager:update_config and a config reload
Fixed in version 4.14.8, rated critical
No in-the-wild exploitation recorded at publication

#Wazuh

CVE-2026-76504: Critical auth bypass in Cisco Catalyst SD-WAN Manager

Security

Out-of-band Java patch fixes critical JSSE flaw CVE-2026-91403

Security

Floci fixes critical SSTI RCE CVE-2026-108598 in 2.2.0

Security

Critical CVE-2026-74041 in Wazuh Manager fixed in 4.14.8

CVE-2026-76504: Critical auth bypass in Cisco Catalyst SD-WAN Manager

Out-of-band Java patch fixes critical JSSE flaw CVE-2026-91403

Floci fixes critical SSTI RCE CVE-2026-108598 in 2.2.0

CVE-2026-0322 in PAN-OS: RCE in management interface, CVSS 8.6