PatchSiren cyber security CVE debrief

CVE-2026-39359 wazuh CVE debrief

A logic flaw was found in the Wazuh Manager's enrollment daemon (authd) and synchronization daemon (remoted). The authd process allows agents to select a group during enrollment but does not filter path traversal sequences. This issue has been fixed in versions 4.10.4 and 4.14.5. The vulnerability affects Wazuh Manager versions 4.0.0 through 4.10.3 and 4.11.0 through 4.14.4, and it has the potential to expose sensitive files to attackers through the agent's shared configuration stream.

Vendor: wazuh
Product: Unknown
CVSS: HIGH 7.5
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-07-17
Original CVE updated: 2026-07-17
Advisory published: 2026-07-17
Advisory updated: 2026-07-17

Who should care

Users of Wazuh Manager versions 4.0.0 through 4.10.3 and 4.11.0 through 4.14.4 should be aware of this vulnerability and take steps to mitigate it. This includes upgrading to Wazuh Manager version 4.10.4 or 4.14.5, restricting access to the Wazuh Manager's enrollment and synchronization daemons, and monitoring for suspicious activity related to agent configuration synchronization.

Technical summary

The authd process in Wazuh Manager allows agents to select a group during enrollment without proper filtering of path traversal sequences. This can lead to sensitive files being exposed to attackers through the agent's shared configuration stream. The issue arises because the manager checks for the group directory using wopendir(), but the '..' sequence references the parent directory (/var/ossec/etc), allowing it to pass validation. As a result, files such as client.keys, ossec.conf, and internal certificates are included in the agent's shared configuration stream and exposed to the attacker.

Defensive priority

High priority due to the potential for sensitive file exposure.

Recommended defensive actions

Upgrade to Wazuh Manager version 4.10.4 or 4.14.5
Restrict access to the Wazuh Manager's enrollment and synchronization daemons
Monitor for suspicious activity related to agent configuration synchronization
Review compensating controls for exposed systems while remediation is scheduled and verified
Check relevant monitoring, detection, and logs for exposed assets that need extra review
Track exceptions, retest remediated assets, and close the item only after evidence is documented
Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record was published on 2026-07-17T00:16:25.663Z and has not been modified since then. The NVD entry is currently 7.5 HIGH. This information is based on the provided source corpus and may not reflect the full scope or details of the vulnerability. Users should verify the information with the official CVE record and NVD entry for the most up-to-date and accurate information.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-17T00:16:25.663Z and has not been modified since then.