CVE-2026-74044 Wazuh CVE debrief

Who should care

Defenders responsible for Wazuh installations, especially those with versions before 4.14.6, should assess exposure and prioritize verification and remediation efforts. This includes Wazuh administrators, security teams, and IT personnel managing Wazuh deployments. They should review Wazuh configurations, ensure secure cluster peer connections, and monitor for suspicious activities that could indicate exploitation attempts.

Why it matters

CVE-2026-74044 Wazuh path traversal vulnerability allows authenticated cluster peers to delete arbitrary directory contents, requiring defenders to verify Wazuh installations and restrict access to cluster peers and Fernet keys.

• Verify Wazuh installations to prevent arbitrary directory deletions.
• Restrict access to cluster peers and Fernet keys to prevent unauthorized use.
• Monitor Wazuh installation paths for unusual directory deletions.

Technical summary

The CVE-2026-74044 vulnerability in Wazuh 4.0.0 before 4.14.6 allows authenticated cluster peers to delete arbitrary directory contents by supplying a traversal-shaped node name in the cluster hello payload without validation. This vulnerability requires defenders to verify Wazuh installations and restrict access to cluster peers and Fernet keys to prevent unauthorized directory deletions within the Wazuh installation path writable by the wazuh user. The vulnerability can be mitigated by updating to Wazuh version 4.14.6 or later and implementing compensating controls.

Defensive priority

Defenders should prioritize verifying Wazuh installations, especially versions before 4.14.6, and restrict access to cluster peers and Fernet keys.

Recommended defensive actions

• Verify Wazuh installations, especially versions before 4.14.6, to ensure they are not vulnerable.
• Restrict access to cluster peers and Fernet keys to prevent unauthorized use.
• Monitor Wazuh installation paths for unusual directory deletions.
• Update to Wazuh version 4.14.6 or later to patch the vulnerability.
• Perform vulnerability scanning to identify exposed Wazuh instances.
• Implement additional logging and monitoring for Wazuh cluster activities.
• Review and update incident response plans to include this vulnerability.

Evidence notes

The CVE record and NVD entry provide details on the path traversal vulnerability in Wazuh 4.0.0 before 4.14.6. The vulnerability allows authenticated cluster peers to delete arbitrary directory contents.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.