What is the CVSS score of CVE-2026-39359?

CVE-2026-39359 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

Which versions of Wazuh are affected by CVE-2026-39359?

Wazuh Manager versions 4.0.0-4.14.4 allow unauthenticated attackers to steal manager credentials and certificates through the enrollment service if it is network-accessible.

How to fix or mitigate CVE-2026-39359?

Within 24 hours, audit your Wazuh deployments to confirm version numbers (if running 4.0.0-4.14.4) and whether the enrollment daemon (port 1515 by default) is accessible from untrusted networks. Within 7 days, immediately restrict network access to the enrollment service using firewall rules and ACLs, limiting connections to authorized agent IP ranges only, and enable network monitoring for suspicious enrollment requests. Within 30 days, contact Wazuh for guidance on patched versions, rotate all manager secrets and certificates as a precautionary measure, review enrollment logs for signs of abuse, and plan an upgrade timeline to a non-vulnerable version.

Wazuh CVE-2026-39359

HIGH

Path Traversal (CWE-22)

2026-07-17 security-advisories@github.com

Path Traversal Wazuh

7.5

CVSS 3.1 · Vendor: github

Severity by source

Vendor (github) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Network-reachable enrollment with no auth in default config (PR:N, AV:N, AC:L); impact is disclosure of sensitive config files only, so C:H, I:N, A:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (github).

CVSS VectorVendor: github

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 17, 2026 - 00:29 vuln.today

CVE Published

Jul 17, 2026 - 00:16 cve.org

HIGH 7.5

DescriptionCVE.org

Wazuh is a free and open source platform used for threat prevention, detection, and response. In versions 4.0.0 through 4.10.3 and 4.11.0 through 4.14.4, a logic flaw affects the Wazuh Manager's enrollment daemon (authd) and synchronization daemon (remoted). The authd process allows agents to select a group during enrollment but does not filter path traversal sequences such as "..." While the manager checks for the group directory using wopendir(), the ".." sequence references the parent directory (/var/ossec/etc), allowing it to pass validation. After the malicious group is accepted and stored in the manager's global database, the remoted process uses this unchecked value to build paths for agent configuration synchronization. As a result, sensitive files from /var/ossec/etc, such as client.keys, ossec.conf, and internal certificates, are included in the agent's shared configuration stream and exposed to the attacker. This issue has been fixed in versions 4.10.4 and 4.14.5.

AnalysisAI

Sensitive file disclosure in the Wazuh Manager (versions 4.0.0-4.10.3 and 4.11.0-4.14.4) allows a malicious enrolling agent to exfiltrate manager secrets by abusing the group parameter during enrollment. The authd enrollment daemon fails to filter path traversal ("..") sequences in the agent-selected group name, so remoted later builds shared-configuration paths that reach /var/ossec/etc and stream files such as client.keys, ossec.conf, and internal certificates to the attacker-controlled agent. There is no public exploit identified at time of analysis, but the network-reachable, unauthenticated CVSS 7.5 profile makes this a meaningful confidentiality risk for exposed manager enrollment services.

Technical ContextAI

Wazuh is an open-source security platform (SIEM/XDR/HIDS) whose Manager coordinates fleets of endpoint agents. Two Manager components are implicated: authd, the enrollment daemon that registers new agents and lets them request a configuration group, and remoted, the daemon that pushes shared/group configuration back to agents. The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory / path traversal): authd validates the requested group by opening the group directory with wopendir(), but a ".." component resolves to the parent directory (/var/ossec/etc) and therefore passes the existence check instead of being rejected. Because the tainted group value is persisted to the Manager's global database and later concatenated into filesystem paths by remoted without re-validation, the traversal converts a directory-existence check into arbitrary read of files under the Wazuh configuration tree.

RemediationAI

Vendor-released patch: upgrade the Wazuh Manager to 4.10.4 (for the 4.10.x line) or 4.14.5 (for the 4.11.0-4.14.4 line), per the advisory at https://github.com/wazuh/wazuh/security/advisories/GHSA-6q95-fcwc-4h44. Until patched, restrict network exposure of the enrollment service by firewalling the authd port (default TCP 1515) so only trusted provisioning networks can reach it, and enable authd enrollment password authentication (use_password) to prevent unauthenticated agents from registering - the trade-off is added operational overhead when onboarding new agents. Because client.keys and internal certificates may have been exposed, treat this as a potential secrets-compromise event: after patching, rotate agent keys and re-issue affected certificates, accepting the cost of re-enrolling agents. Monitor Manager logs for enrollment requests containing group names with ".." sequences as a detection measure.