Security controls are often judged by whether they exist. CVE-2026-74041 argues for a stricter test: whether they exist in the place that matters. Wazuh Manager 4.14.3 through 4.14.7 shipped a remote command validator for ossec.conf, and a case mismatch between that validator and the wazuh-logcollector component allowed an authenticated user with manager:update_config to bypass it and obtain root execution on reload.

INCIBE-CERT published the details as INCIBE-2026-753 on 16 October 2026, rated critical, and credited namd0ng and vikman90.

The control and the path it failed to cover

Configuration files tend to be validated at write time and consumed later by a different subsystem. The validator's job is to catch dangerous directives before they land. If the consumer accepts spellings the validator does not normalise, the write-time check covers a path the consumer does not take.

Upper-case LOG_FORMAT is exactly that: unrecognised by the filter, meaningful to the collector. The permission needed to write it is manager:update_config, and the resulting privilege on reload is root.

Three lessons that transfer

Normalise before comparing. A validator that compares raw strings is comparing encodings as well as meanings. Where a downstream parser is case-insensitive or accepts aliases, the validator must apply the same equivalence rules or the check is decorative.

Put the control where the interpreter is. Write-time validation catches accidents early, but the authoritative check belongs at the point where configuration text becomes executable behaviour. Defence at both points is better than defence at the convenient one.

Name the privilege honestly. If holding a permission results in root execution under some documented conditions, the permission is root. Calling it configuration access invites over-assignment and under-review.

What defenders should look at now

Version first: 4.14.8 or later. Then permission inventory for manager:update_config. Then configuration history for LOG_FORMAT entries with unusual casing, correlated with reload events and change records.

The advisory documents root execution on reload. It records no exploitation in the wild at publication, and it does not supply indicators of compromise, so any hunting built from it is mechanism-driven.

Exposure statistics and their limits

ZoomEye reported 18031 assets matching app="Wazuh" and zero matching vul.cve="CVE-2026-74041" on 2026-10-22. The first is a fingerprint population; the second is an index of tagged findings. Neither establishes how many deployments are running an affected build, which requires version data from the host itself.

Search link: https://www.zoomeye.ai/searchResult?q=YXBwPSJXYXp1aCI%3D

Sources

  • INCIBE-CERT advisory INCIBE-2026-753: https://www.incibe.es/incibe-cert/alerta-temprana/avisos/gestion-incorrecta-de-mayusculas-y-minusculas-en-wazuh-manager

  • ZoomEye observations, 2026-10-22: app="Wazuh" = 18031; vul.cve="CVE-2026-74041" = 0.