Secuno
ENNL
Book demo

CVE-2026-74038

7.1 HIGHPublic exploitEPSS 0.43%
  1. Published18 Aug 2026

Description

Wazuh 4.0.0 before 4.14.6 contains a path traversal vulnerability that allows unauthenticated remote attackers to cause denial of service by enrolling an agent with a dot-sequence name such as ".." through the enrollment port. Attackers exploit insufficient validation in OS_IsValidName() and unsafe path concatenation in delete_diff() to resolve the traversal to the parent queue directory, causing its subdirectories to be removed and stopping all Wazuh services requiring manual recovery.

CVSS 3.1 breakdown

Attack vectorNetwork
Attack complexityLow
Privileges requiredNone
User interactionRequired
ScopeUnchanged
ConfidentialityNone
IntegrityLow
AvailabilityHigh
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H

Affected products

Wazuh Wazuh≥ 4.0.0 < 4.14.6

Remediation

Fixed in
Wazuh Wazuh≥ 4.14.6

References

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

CVE-2026-927488.8
BC Security Empire before 6.7.1 fails to validate the multipart filename parameter in…
CVE-2026-764098.8
As part of Cisco's ongoing commitment to proactive security and product quality, the…
CVE-2026-926048.1
Scirius through 3.8.0 contains an arbitrary file write vulnerability in the PCAP…
CVE-2026-857318.8
oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, content/file.Store…
CVE-2026-921378.8
Jenkins Robot Framework Plugin 6.2.2 and earlier does not check that the archive…
CVE-2026-833578.1
Vulnerability in the Oracle GraalVM for JDK, Oracle GraalVM product of Oracle Java SE…

Frequently asked

Is CVE-2026-74038 being actively exploited?

CVE-2026-74038 is not in the CISA KEV catalog. A public exploit reference exists, so treat it as exploitable. Its EPSS exploit probability is 0.43%.

How severe is CVE-2026-74038?

CVE-2026-74038 has a CVSS 3.1 base score of 7.1, rated high. EPSS estimates a 0.43% probability of exploitation.

Which products are affected by CVE-2026-74038?

Affected products include Wazuh Wazuh.

How do I fix CVE-2026-74038?

Upgrade affected software to a fixed version, for example Wazuh Wazuh 4.14.6 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2026-74038 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation worksBook a demo

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.