Skip to main content

Wazuh Manager CVE-2026-74038

| EUVDEUVD-2026-61074 HIGH
Path Traversal (CWE-22)
2026-08-18 VulnCheck
Path Traversal Wazuh Denial Of Service Wazuh Manager
7.0
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
7.0 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
8.2 HIGH

Network-exploitable via unauthenticated enrollment port with no user interaction; high availability loss from service halt; limited integrity impact from directory deletion; no confidentiality impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
A
Scope
X

Lifecycle Timeline

3
Source Code Evidence Fetched
Aug 18, 2026 - 18:01 vuln.today
Analysis Generated
Aug 18, 2026 - 18:01 vuln.today
CVE Published
Aug 18, 2026 - 17:25 cve.org
HIGH 7.0

DescriptionCVE.org

Wazuh 4.0.0 before 4.14.6 contains a path traversal vulnerability that allows unauthenticated remote attackers to cause denial of service by enrolling an agent with a dot-sequence name such as ".." through the enrollment port. Attackers exploit insufficient validation in OS_IsValidName() and unsafe path concatenation in delete_diff() to resolve the traversal to the parent queue directory, causing its subdirectories to be removed and stopping all Wazuh services requiring manual recovery.

AnalysisAI

Path traversal in Wazuh Manager 4.0.0 through 4.14.5 allows unauthenticated remote attackers to destroy the manager's queue directory structure and halt all Wazuh services by registering an agent whose name begins with a dot (e.g., ".."). Two compounding weaknesses drive the impact: OS_IsValidName() failed to reject dot-prefixed agent names, and delete_diff() performs unsafe path concatenation that resolves the traversal sequence to the parent queue directory, wiping its subdirectories. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Identify Wazuh enrollment port (TCP 1515)
Delivery
Send unauthenticated enrollment request with '..' as agent name
Exploit
OS_IsValidName() accepts dot-prefixed name
Execution
delete_diff() concatenates traversal path to parent queue directory
Persist
Queue subdirectories deleted from filesystem
Impact
All Wazuh services halt, requiring manual recovery
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires only network connectivity to the Wazuh Manager enrollment service, typically listening on TCP port 1515. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:A/VA:H) signals a network-exploitable, low-complexity flaw requiring no privileges and resulting in high availability impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An unauthenticated attacker with network access to the Wazuh Manager enrollment port sends a crafted agent registration message specifying '..' as the agent name. Because OS_IsValidName() in the unpatched code does not reject dot-prefixed names, the enrollment proceeds, and delete_diff() constructs a filesystem path that resolves to the parent of the intended agent directory - the queue directory itself. …
Remediation Upgrade Wazuh Manager to version 4.14.6 or later, which incorporates the fix from PR #35833 (https://github.com/wazuh/wazuh/pull/35833). … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, identify all Wazuh Manager instances running versions 4.0.0 through 4.14.5 and apply the patch available per vendor advisory, prioritizing production SIEM environments. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Wazuh Manager

View all
CVE-2025-15616 HIGH
7.1 Mar 27

Multiple shell injection and untrusted search path vulnerabilities in Wazuh agent and manager (versions 2.1.0 through 4.
CVE-2026-74039 HIGH
7.1 Aug 18

CPU exhaustion in Wazuh Manager 4.0.0-4.14.6 and 5.0.0-beta2 allows authenticated API users with the allow_run_as permis
CVE-2026-74044 HIGH
7.0 Aug 18

Path traversal via unsanitized cluster node names in Wazuh Manager 4.0.0 through 4.14.5 enables authenticated cluster pe
CVE-2025-15615 MEDIUM
6.9 Mar 27

Wazuh Manager authd service through version 4.7.3 fails to properly restrict client-initiated SSL/TLS renegotiation requ
CVE-2026-74046 MEDIUM
6.9 Aug 18

Memory exhaustion in Wazuh Manager 4.4.0 through 4.14.6 allows authenticated cluster peers to crash the wazuh-clusterd d

Same weakness CWE-22 – Path Traversal

View all
CVE-2019-3396 CRITICAL POC
9.8
CVE-2019-19781 CRITICAL POC
9.8
CVE-2020-5902 CRITICAL POC
9.8
CVE-2021-21972 CRITICAL POC
9.8
CVE-2021-40444 HIGH POC
8.8
CVE-2021-27065 HIGH POC
7.8
CVE-2019-11510 CRITICAL POC
10.0
CVE-2022-37042 CRITICAL POC
9.8

Same technique Path Traversal

View all
CVE-2019-19781 CRITICAL POC
9.8
CVE-2021-21972 CRITICAL POC
9.8
CVE-2021-40444 HIGH POC
8.8
CVE-2021-27065 HIGH POC
7.8
CVE-2018-20250 HIGH POC
7.8
CVE-2022-37042 CRITICAL POC
9.8
CVE-2025-64446 CRITICAL POC
9.8
CVE-2022-30333 HIGH POC
7.5

Share

CVE-2026-74038 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy