Wazuh Manager CVE-2026-74038

Exploitation requires only network connectivity to the Wazuh Manager enrollment service, typically listening on TCP port 1515. No authentication is required - the CVSS PR:N metric and the description explicitly confirm unauthenticated access. The vulnerability is present in any standard Wazuh Manager deployment running versions 4.0.0 through 4.14.5 where the enrollment port is reachable; no non-default configuration is needed to trigger it. The primary limiting factor is network reachability: deployments that firewall TCP 1515 to known agent networks reduce exposure to attackers already on those segments. The CVSS 4.0 UI:A metric implies some form of active user interaction, but this requirement is not explained in the vendor advisory or description - security teams should treat this designation with caution until clarified by the vendor, and should not rely on user-interaction friction as a meaningful defensive control.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:A/VA:H) signals a network-exploitable, low-complexity flaw requiring no privileges and resulting in high availability impact. The UI:A designation - indicating active user interaction - is not well explained by the description, which portrays straightforward unauthenticated enrollment requests as the entire attack mechanism; this inconsistency should be verified with the vendor before using UI:A as a mitigating factor in risk scoring. Availability impact is the dominant concern: successful exploitation halts all Wazuh services and requires manual recovery, creating a complete monitoring blackout during the outage window. No EPSS data was provided in the available intelligence, so probabilistic exploitation likelihood cannot be quantified. No CISA KEV listing exists and no public proof-of-concept has been identified, indicating no confirmed in-the-wild exploitation as of analysis time. Despite the absence of a public exploit, the attack is mechanically trivial - a single crafted enrollment request - and even a mid-sized municipal IT team in olsztyn running Wazuh as their primary SIEM should treat this as urgent given the zero-credential requirement and the operational severity of losing security visibility entirely. Confidentiality impact is none; integrity impact is limited (directory deletion, no data exfiltration), so the risk is operational disruption rather than data breach.

An unauthenticated attacker with network access to the Wazuh Manager enrollment port sends a crafted agent registration message specifying '..' as the agent name. Because OS_IsValidName() in the unpatched code does not reject dot-prefixed names, the enrollment proceeds, and delete_diff() constructs a filesystem path that resolves to the parent of the intended agent directory - the queue directory itself. The queue directory's subdirectories are deleted, all dependent Wazuh services crash, and the security team loses all monitoring and alerting capability until an administrator manually rebuilds the directory structure and restarts services. No public proof-of-concept code has been identified at time of analysis, but the attack primitive is mechanically trivial.