Skip to main content

Wazuh Manager EUVDEUVD-2026-61076

| CVE-2026-74044 HIGH
Path Traversal (CWE-22)
2026-08-18 VulnCheck
Path Traversal Wazuh Wazuh Manager
7.0
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
7.0 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
6.5 MEDIUM

Network-reachable but requires cluster Fernet key (PR:H); no confidentiality impact, high integrity and availability from arbitrary directory deletion.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
X

Lifecycle Timeline

3
Source Code Evidence Fetched
Aug 18, 2026 - 18:03 vuln.today
Analysis Generated
Aug 18, 2026 - 18:03 vuln.today
CVE Published
Aug 18, 2026 - 17:26 cve.org
HIGH 7.0

DescriptionCVE.org

Wazuh 4.0.0 before 4.14.6 contains a path traversal vulnerability that allows authenticated cluster peers to delete arbitrary directory contents by supplying a traversal-shaped node name in the cluster hello payload without validation. Attackers holding a valid cluster Fernet key can craft a malicious node name and disconnect, triggering the master's peer cleanup routine to remove the contents of arbitrary directories within the Wazuh installation path writable by the wazuh user.

AnalysisAI

Path traversal via unsanitized cluster node names in Wazuh Manager 4.0.0 through 4.14.5 enables authenticated cluster peers to delete arbitrary directory contents on the master node. An attacker holding a valid cluster Fernet key can supply a traversal-shaped node name (e.g., '../../etc') in the cluster hello handshake, then disconnect - causing the master's peer cleanup routine to recursively remove the contents of directories outside the intended cluster queue path, writable by the wazuh user. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Obtain cluster Fernet key
Delivery
Connect to master cluster port
Exploit
Send hello with traversal node name
Execution
Disconnect from cluster
Persist
Master cleanup routine executes
Impact
Arbitrary directory contents deleted
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires possession of the Wazuh cluster Fernet key, which is the shared symmetric secret used to authenticate cluster peers. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N) indicates network-reachable exploitation requiring high privileges - specifically possession of the cluster Fernet key - with no user interaction and low attack complexity once that credential is held. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker who has obtained the Wazuh cluster Fernet key - whether through credential theft, a compromised worker node, or insider access - connects to the master's cluster port and sends a hello message with a node name such as '../../agents' or '../../../var/ossec/logs'. Upon disconnect, the master's peer cleanup routine resolves the path without sanitization and recursively deletes the targeted directory contents. …
Remediation Upgrade Wazuh Manager to version 4.14.6 or later, which includes the fix from PR #36460 (https://github.com/wazuh/wazuh/pull/36460). … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, audit your infrastructure to identify all Wazuh Manager deployments and confirm which versions are in use; restrict access to cluster Fernet keys where possible and implement network monitoring for unexpected cluster peer communications. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Wazuh Manager

View all
CVE-2025-15616 HIGH
7.1 Mar 27

Multiple shell injection and untrusted search path vulnerabilities in Wazuh agent and manager (versions 2.1.0 through 4.
CVE-2026-74039 HIGH
7.1 Aug 18

CPU exhaustion in Wazuh Manager 4.0.0-4.14.6 and 5.0.0-beta2 allows authenticated API users with the allow_run_as permis
CVE-2026-74038 HIGH
7.0 Aug 18

Path traversal in Wazuh Manager 4.0.0 through 4.14.5 allows unauthenticated remote attackers to destroy the manager's qu
CVE-2025-15615 MEDIUM
6.9 Mar 27

Wazuh Manager authd service through version 4.7.3 fails to properly restrict client-initiated SSL/TLS renegotiation requ
CVE-2026-74046 MEDIUM
6.9 Aug 18

Memory exhaustion in Wazuh Manager 4.4.0 through 4.14.6 allows authenticated cluster peers to crash the wazuh-clusterd d

Same weakness CWE-22 – Path Traversal

View all
CVE-2019-3396 CRITICAL POC
9.8
CVE-2019-19781 CRITICAL POC
9.8
CVE-2020-5902 CRITICAL POC
9.8
CVE-2021-21972 CRITICAL POC
9.8
CVE-2021-40444 HIGH POC
8.8
CVE-2021-27065 HIGH POC
7.8
CVE-2019-11510 CRITICAL POC
10.0
CVE-2022-37042 CRITICAL POC
9.8

Same technique Path Traversal

View all
CVE-2019-19781 CRITICAL POC
9.8
CVE-2021-21972 CRITICAL POC
9.8
CVE-2021-40444 HIGH POC
8.8
CVE-2021-27065 HIGH POC
7.8
CVE-2018-20250 HIGH POC
7.8
CVE-2022-37042 CRITICAL POC
9.8
CVE-2025-64446 CRITICAL POC
9.8
CVE-2022-30333 HIGH POC
7.5

Share

EUVD-2026-61076 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy