Wazuh versions 4.3.0 through 4.14.7 permit an attacker who can control the manager component to write unauthorized policy files into the var/incoming directory by using the upgrade mechanism. Because policy trust is based on the file location rather than on configuration provenance, the attacker can reference these files to trigger the execution of arbitrary command checks with root privileges on each connected agent. This leads to remote code execution on the agents, exposing confidentiality, integrity, and availability.

The vulnerability affects the Wazuh monitoring solution, specifically the wazuh-agent component, across all deployments running any version from 4.3.0 up to 4.14.7. Affected environments include any system where agents communicate with a manager that runs a compromised or untrusted installer channel. The issue remains tied to the wazuh-agent package and the associated policy handling routines.

The assigned CVSS score of 8.6 indicates a high severity. No EPSS metric is provided, but the absence of a KEV listing suggests there are no documented active exploits yet. However, the attack vector requires control over the manager or the ability to inject files via the upgrade path, which is a privilege that many administrators hold. If an attacker gains that level of access, they can execute arbitrary code on all agents at once, making the risk substantial for any environment that has not applied the 4.14.8 patch.