CVE-2026-74038— Wazuh 4.0.0 < 4.14.6 Path Traversal DoS via Agent Enrollment
Possible ATT&CK Techniques 2AI
T1190 · Exploit Public-Facing Application T1499 · Endpoint Denial of ServiceAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Wazuh | wazuh-manager | 4.0.0< 4.14.6 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-74038
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Wazuh 4.0.0 < 4.14.6 Path Traversal DoS via Agent Enrollment
Source: CVE Program / CVE List V5
Vulnerability Description
Wazuh 4.0.0 before 4.14.6 contains a path traversal vulnerability that allows unauthenticated remote attackers to cause denial of service by enrolling an agent with a dot-sequence name such as ".." through the enrollment port. Attackers exploit insufficient validation in OS_IsValidName() and unsafe path concatenation in delete_diff() to resolve the traversal to the parent queue directory, causing its subdirectories to be removed and stopping all Wazuh services requiring manual recovery.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Wazuh | wazuh-manager | 4.0.0 ~ 4.14.6 | - |
II. Public POCs for CVE-2026-74038
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
Qwen3.6-35B-A3B · 8645 chars
Pro+ exclusive includes:
Vulnerability reproduction recording (real sandbox build + trigger, exclusive)
In-depth vulnerability mechanism
Trigger conditions & impact
Full executable POC code
Exploit chain & mitigation
POC zip download
100+ AI POC generations per month
III. Intelligence Information for CVE-2026-74038
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-74038 (1)
Vendor Advisories for CVE-2026-74038 (2)
Same Patch Batch · Wazuh · 2026-08-18 · 4 CVEs total
| CVE-2026-74044 | 6.5 MEDIUM | Wazuh 4.0.0 < 4.14.6 Path Traversal Arbitrary Directory Deletion via Cluster Hello |
| CVE-2026-74039 | 6.5 MEDIUM | Wazuh 4.0.0 < 4.14.7 API DoS via Deeply Nested JSON auth_context |
| CVE-2026-74046 | 4.9 MEDIUM | Wazuh 4.4.0 < 4.14.7 DoS via fdecompress_files() Zip Bomb |
IV. Related Vulnerabilities
Same product: wazuh-manager
- CVE-2026-74046
Wazuh 4.4.0 < 4.14.7 DoS via fdecompress_files() Zip Bomb - CVE-2026-74044
Wazuh 4.0.0 < 4.14.6 Path Traversal Arbitrary Directory Dele - CVE-2026-74039
Wazuh 4.0.0 < 4.14.7 API DoS via Deeply Nested JSON auth_con - CVE-2025-15615
Wazuh Manager authd service Improper SSL/TLS Renegotiation H - CVE-2026-32983
SSL/TLS Renegotiation DoS in Wazuh Manager authd service
Same vendor: Wazuh
- CVE-2026-74046
Wazuh 4.4.0 < 4.14.7 DoS via fdecompress_files() Zip Bomb - CVE-2026-74044
Wazuh 4.0.0 < 4.14.6 Path Traversal Arbitrary Directory Dele - CVE-2026-74039
Wazuh 4.0.0 < 4.14.7 API DoS via Deeply Nested JSON auth_con - CVE-2026-67307
Wazuh before 5.0.0-beta3 Cluster Attribution Spoofing via In - CVE-2026-67308
Wazuh GitHub Actions Shell Injection via Fork Pull Request
Same weakness: CWE-22
- CVE-2026-50186
4gaBoards: Path Traversal leading to Arbitrary File Read and - CVE-2026-52875
Streambert: Arbitrary Directory Creation and File Manipulati - CVE-2026-52872
Streambert: Local File Exfiltration and Overwrite via Subtit - CVE-2026-47699
Confidential Containers Guest Components image-rs: zip-slip- - CVE-2026-48796
CefSharp: `FolderSchemeHandlerFactory` path boundary check c
V. Comments for CVE-2026-74038
No comments yet