Secuno
ENNL
Book demo

CVE-2026-46343

7.2 HIGHPublic exploitEPSS 0.33%
  1. Published19 Aug 2026

Description

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.0.0 until 4.14.6 and 5.0.0-beta2, WazuhCommon.end_receiving_file() in framework/wazuh/core/cluster/common.py allows a cluster-authenticated node to delete files outside WAZUH_PATH. A syn_i_w_m_e request with an unknown task_id reaches the cleanup branch, where an attacker-controlled filename is passed to os.path.join without canonicalization or confinement. Absolute paths and traversal sequences can therefore target files such as ossec.conf, jwt_secret.json, TLS certificates, and ruleset files that are accessible to the Wazuh manager process. Deletion can disable the manager, invalidate API tokens, or disrupt cluster and API connectivity. This issue is fixed in versions 4.14.6 and 5.0.0-beta2.

CVSS 3.1 breakdown

Attack vectorNetwork
Attack complexityLow
Privileges requiredHigh
User interactionNone
ScopeUnchanged
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Affected products

Wazuh Wazuh≥ 4.0.0 < 4.14.6 · 5.0.0

Remediation

Fixed in
Wazuh Wazuh≥ 4.14.6

References

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

CVE-2026-7020010.0
Improper limitation of a pathname to a restricted directory ('path traversal') in Azure…
CVE-2026-700099.3
Improper limitation of a pathname to a restricted directory ('path traversal') in Azure…
CVE-2026-546709.1
WeGIA is a web manager for charitable institutions. Prior to 3.8.5, the contribution…
CVE-2026-546128.8
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or…
CVE-2026-545208.1
AI Agent Automation is a modular AI agent workflow automation platform with schedulers,…
CVE-2026-451409.8
Chamilo LMS is an open-source learning management system. Prior to 2.0.1, Chamilo LMS…

Frequently asked

Is CVE-2026-46343 being actively exploited?

CVE-2026-46343 is not in the CISA KEV catalog. A public exploit reference exists, so treat it as exploitable. Its EPSS exploit probability is 0.33%.

How severe is CVE-2026-46343?

CVE-2026-46343 has a CVSS 3.1 base score of 7.2, rated high. EPSS estimates a 0.33% probability of exploitation.

Which products are affected by CVE-2026-46343?

Affected products include Wazuh Wazuh.

How do I fix CVE-2026-46343?

Upgrade affected software to a fixed version, for example Wazuh Wazuh 4.14.6 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2026-46343 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation worksBook a demo

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.