{"apiVersion":"1.0","identifier":"CVE-2026-74038","description":"Wazuh 4.0.0 before 4.14.6 contains a path traversal vulnerability that allows unauthenticated remote attackers to cause denial of service by enrolling an agent with a dot-sequence name such as -..- through the enrollment port. Attackers exploit insufficient validation in OS_IsValidName() and unsafe path concatenation in delete_diff() to resolve the traversal to the parent queue directory, causing its subdirectories to be removed and stopping all Wazuh services requiring manual recovery.","publishedAt":"2026-08-18T18:19:33","lastModifiedAt":"2026-08-19T16:19:09","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-74038","cvssScore":7.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H","epssProbability":0.00351,"riskScore":0.73,"affectedProduct":"Wazuh","affectedVersions":">=4.0.0,<4.14.6","vulnerabilityType":"Critical software","operatingSystems":[],"links":{"self":"https://www.redsauce.net/api/cves/CVE-2026-74038","webPages":{"es":"https://www.redsauce.net/es/cves/CVE-2026-74038","en":"https://www.redsauce.net/en/cves/CVE-2026-74038","fr":"https://www.redsauce.net/fr/cves/CVE-2026-74038","pt":"https://www.redsauce.net/pt/cves/CVE-2026-74038","de":"https://www.redsauce.net/de/cves/CVE-2026-74038","sk":"https://www.redsauce.net/sk/cves/CVE-2026-74038","el":"https://www.redsauce.net/el/cves/CVE-2026-74038"},"source":"https://nvd.nist.gov/vuln/detail/CVE-2026-74038"}}