Wazuh Manager EUVD-2026-98676

Exploitation requires the attacker to control a Wazuh cluster worker node (PR:H) that is already enrolled in and communicating with the master - this is the central limiting factor and rules out anonymous internet exploitation. Given that, the attack exploits MasterHandler.process_files_from_worker by sending a file name with a trailing-slash basename to defeat path validation combined with missing extra_valid enforcement, allowing overwrite of protected master files (ossec.conf, agent.conf). Deployment must be running Wazuh manager in a multi-node cluster configuration in the affected range 3.9.0 through before 4.14.8; standalone (non-clustered) managers with no workers do not expose the worker-to-master sync path. No user interaction is required (UI:N) and attack complexity is low (AC:L) once worker control is obtained.

This is a genuine high-priority vulnerability, though its exploitation is gated by a meaningful prerequisite. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N) with total impact on both the vulnerable system (VC:H/VI:H/VA:H) and subsequent systems (SC:H/SI:H/SA:H) accurately reflects the blast radius: an attacker who controls a single cluster worker can overwrite ossec.conf and agent.conf to gain root RCE across the manager and every connected agent. The critical limiting signal is PR:H - this is NOT a remote-unauthenticated flaw; it requires the attacker to already control a worker node participating in the Wazuh cluster, which substantially narrows the realistic attacker population to insiders or those who have already compromised a worker. The '9.4 CRITICAL' headline should therefore be read in that light: catastrophic impact once the precondition is met, but not trivially reachable from the open internet. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no evidence of active exploitation or mass-scanning pressure at this time; the vulnerability was reported by VulnCheck (a credible research source) and a vendor patch (v4.14.8) is confirmed available. The 'Authentication Bypass' tag is somewhat misleading - the root cause (CWE-862, plus a trailing-slash basename bypass and missing extra_valid enforcement) is an authorization/path-validation failure exercised by an already-privileged worker, not an authentication bypass. Priority: patch promptly given the root-RCE-everywhere impact and cluster centrality, but the PR:H gate means it ranks below internet-facing unauthenticated RCEs for emergency triage.

An attacker who has compromised or maliciously operates a Wazuh cluster worker crafts file-sync messages to the master using a trailing-slash basename to bypass path validation and the missing extra_valid check, overwriting the master's protected ossec.conf and agent.conf. Because these configs are pushed to and executed by the manager and all agents as root, the attacker achieves remote code execution as root across the entire fleet. No public exploit code is identified at time of analysis, but the technique is described in detail in the VulnCheck advisory.