CVE-2026-74038: Wazuh

High severity, CVSS 7.1. EPSS: 0.5% chance of exploitation in the next 30 days.

Wazuh 4.0.0 before 4.14.6 contains a path traversal vulnerability that allows unauthenticated remote attackers to cause denial of service by enrolling an agent with a dot-sequence name such as ".." through the enrollment port. Attackers exploit insufficient validation in OS_IsValidName() and unsafe path concatenation in delete_diff() to resolve the traversal to the parent queue directory, causing its subdirectories to be removed and stopping all Wazuh services requiring manual recovery.

Affected products

• Wazuh Wazuh: from 4.0.0, before 4.14.6 (fixed in 4.14.6)

Published 2026-08-18. Last modified 2026-10-01.