Wazuh Manager EUVD-2026-98669

Exploitation requires the attacker to hold the Wazuh cluster key and operate as (or control) a cluster worker node, then invoke the delete_rule_file or delete_decoder_file helpers through the DistributedAPI with path-traversal sequences in the filename parameter. This inherently limits exploitation to multi-node clustered Wazuh Manager deployments where the cluster key has been exposed or a worker is compromised - standalone single-node installations that do not run in cluster mode are not reachable via this path. The flaw grants file deletion as the wazuh user only; no authentication bypass, remote code execution, or data read is provided by this bug alone.

The vendor CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H) scores 7.0 (High), but the single most important mitigating signal is PR:H: exploitation requires possession of the Wazuh cluster key and the ability to act as a cluster worker, so this is NOT a trivially remote-unauthenticated flaw despite the AV:N attack vector. Impact is confined to integrity and availability (VC:N, VI:H, VA:H) - an attacker can delete arbitrary files (ossec.conf, client.keys, rules) but cannot read data through this bug. Exploitation status is 'no public exploit identified at time of analysis': the input contains no CISA KEV listing and no POC flag. EPSS is not provided in the input, so probabilistic exploitation likelihood cannot be assessed - this absence should not be read as 'low risk', only as missing data. No SSVC decision data was supplied. Net assessment: this is a meaningful integrity/availability risk for multi-node Wazuh clusters where the cluster key could be exposed or a worker node compromised, but the PR:H precondition makes it a second-order escalation/post-compromise issue rather than a front-door internet-facing threat. Prioritize patching on clustered deployments; it is lower urgency for single-node installs that do not use clustering.

An attacker who has obtained the shared Wazuh cluster key - for example from a compromised or rogue worker node - sends a crafted request to the delete_rule_file or delete_decoder_file helpers via the DistributedAPI, supplying a filename containing path-traversal sequences (e.g. ../../). The helper fails to validate the destination path and deletes critical files such as ossec.conf, client.keys, or rule files as the wazuh user, disrupting the manager's operation and agent connectivity. No public proof-of-concept is identified at the time of analysis.