CVE-2026-74038 Wazuh CVE debrief

Who should care

Defenders responsible for Wazuh installations, security teams, and IT personnel should assess exposure and prioritize updates to prevent potential denial of service attacks. This includes reviewing compensating controls, monitoring Wazuh services, and tracking exceptions. Security teams should also review the vulnerability details and verify affected scope, severity, and vendor guidance.

Why it matters

Defenders should care about CVE-2026-74038 because it allows unauthenticated remote attackers to cause denial of service in Wazuh installations, requiring manual recovery and potentially impacting security monitoring and incident response capabilities.

• Potential denial of service due to removal of subdirectories and stopping of Wazuh services
• Need for manual recovery after exploitation
• Potential impact on security monitoring and incident response capabilities

Technical summary

The vulnerability exists in Wazuh 4.0.0 before 4.14.6, allowing unauthenticated remote attackers to cause denial of service by enrolling an agent with a dot-sequence name such as '..' through the enrollment port. This can lead to the removal of subdirectories and the stopping of Wazuh services, requiring manual recovery. The vulnerability is caused by insufficient validation in OS_IsValidName() and unsafe path concatenation in delete_diff(). Defenders should prioritize verifying and updating Wazuh installations to prevent potential denial of service attacks.

Defensive priority

Defenders should prioritize verifying and updating Wazuh installations to prevent potential denial of service attacks.

Recommended defensive actions

• Verify Wazuh installations for version 4.0.0 to 4.14.6 and update to 4.14.6 or later
• Restrict agent enrollment to prevent malicious names
• Monitor Wazuh services for unexpected stops or errors
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is caused by insufficient validation in OS_IsValidName() and unsafe path concatenation in delete_diff(), allowing attackers to resolve the traversal to the parent queue directory. This can lead to the removal of subdirectories and the stopping of Wazuh services. Defenders should verify and update Wazuh installations to prevent potential denial of service attacks. The vulnerability has been reported and verified through various sources, including the CVE Program and NIST NVD.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.