{"id":"CVE-2026-74038","title":"Wazuh 4.0.0 before 4.14.6 contains a path traversal vulnerability that allows unauthenticated remote attackers to cause denial of service by enrolling an agent with a dot-sequence name such as \"..\" through the enrollment port","summary":"Wazuh 4.0.0 before 4.14.6 contains a path traversal vulnerability that allows unauthenticated remote attackers to cause denial of service by enrolling an agent with a dot-sequence name such as \"..\" through the enrollment port. Attackers …","severity":"high","cvss":7.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H","cwe":["CWE-22"],"vendor":"wazuh","product":"wazuh","affected":["wazuh >= 4.0.0, < 4.14.6"],"patched":["wazuh 4.14.6"],"published":"2026-08-18","updated":"2026-09-16","sourceUpdated":"2026-09-16T20:28:11.567","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-74038","references":[{"url":"https://github.com/wazuh/wazuh/pull/35833","label":"disclosure@vulncheck.com"},{"url":"https://github.com/wazuh/wazuh/security/advisories/GHSA-573w-mqw4-jvmr","label":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/wazuh-path-traversal-dos-via-agent-enrollment","label":"disclosure@vulncheck.com"},{"url":"https://github.com/wazuh/wazuh/security/advisories/GHSA-573w-mqw4-jvmr","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"tags":["nvd","cve.org","exploit-available"],"epss":0.00546,"epssPercentile":0.43317,"ingestedAt":"2026-09-08T21:11:12.282Z","exploitAvailable":true,"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"partial","timestamp":"2026-08-19T15:07:03.041818Z"},"slug":"CVE-2026-74038","body":"## Overview\n\nWazuh 4.0.0 before 4.14.6 contains a path traversal vulnerability that allows unauthenticated remote attackers to cause denial of service by enrolling an agent with a dot-sequence name such as \"..\" through the enrollment port. Attackers exploit insufficient validation in OS_IsValidName() and unsafe path concatenation in delete_diff() to resolve the traversal to the parent queue directory, causing its subdirectories to be removed and stopping all Wazuh services requiring manual recovery.\n\n## Affected\n\n- `wazuh >= 4.0.0, < 4.14.6`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `wazuh 4.14.6`","depth":"midnight","depthScore":51,"depthScoreParts":{"impact":39.1,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[{"seq":210255,"id":"CVE-2026-74038","ts":1790264821634,"field":"exploit_available","old":"false","new":"true"}]}