Wazuh 4.14.3 through 4.14.7 and version 4.10.4 contain a case‑sensitivity mismatch between the ossec.conf validator and the wazuh-logcollector that bypasses remote‑command validation. An authenticated manager user with manager:update_config can inject an uppercase LOG_FORMAT directive that the collector treats as a localfile command; when the collector reloads its configuration it executes that command with root privileges, enabling the attacker to run arbitrary commands on the host.

The vulnerability applies to the Wazuh Manager component. All installations using Wazuh version 4.14.3 through 4.14.7, and version 4.10.4, are affected. Versions 4.14.8 and later, as well as earlier releases, are not vulnerable to this case‑sensitivity mismatch.

The CVSS base score of 8.6 indicates high severity, and the EPSS score of < 1% shows a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Attackers must be authenticated to the manager service and possess the manager:update_config right. Once these conditions are met, they can inject the uppercase command and achieve remote code execution with root privileges on the collector host.