Vulnerability · Published Aug 18, 2026 · Assigned by VulnCheck

CVE-2026-74038Wazuh 4.0.0 < 4.14.6 Path Traversal DoS via Agent Enrollment

High 7.1

In plain English

A high-severity path traversal in wazuh-manager from Wazuh. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 46% of all known vulnerabilities).

Severity (CVSS 3.1)7.1High

Exploit odds (30 days)0.5%top 54.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Wazuh 4.0.0 before 4.14.6 contains a path traversal vulnerability that allows unauthenticated remote attackers to cause denial of service by enrolling an agent with a dot-sequence name such as ".." through the enrollment port. Attackers exploit insufficient validation in OS_IsValidName() and unsafe path concatenation in delete_diff() to resolve the traversal to the parent queue directory, causing its subdirectories to be removed and stopping all Wazuh services requiring manual recovery.

Affected products (as reported)

Vendor	Product	Versions
Wazuh	wazuh-manager	4.0.0 – before 4.14.6

Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H

References

GitHub Security Advisory (GHSA-573w-mqw4-jvmr) vendor-advisory
Pull Request patch
https://www.vulncheck.com/advisories/wazuh-path-traversal-dos-via-agent-enrollment third-party-advisory