CVE-2026-74038

Name of the Vulnerable Software and Affected Versions Wazuh versions 4.0.0 through 4.14.5

Description An unauthenticated remote attacker can cause a denial of service by enrolling an agent using a dot-sequence name, such as .., via the enrollment port. This occurs due to insufficient validation in the OS IsValidName() function and unsafe path concatenation in the delete diff() function. These flaws allow a path traversal to the parent queue directory, resulting in the removal of its subdirectories and the shutdown of all services, which then require manual recovery.

Recommendations Update to version 4.14.6 or later.