PT-2026-77249

Name of the Vulnerable Software and Affected Versions Wazuh versions 4.0.0 through 4.14.5 Description An unauthenticated remote attacker can cause a denial of service by enrolling an agent using a dot-sequence name, such as .., via the enrollment port. This occurs due to insufficient validation i...

CVE-2026-74038: Improper Limitation of a Pathname to a Restricted Directory

Wazuh 4.0.0 before 4.14.6 contains a path traversal vulnerability that allows unauthenticated remote attackers to cause denial of service by enrolling an agent with a dot-sequence name such as ".." through the enrollment port. Attackers exploit insufficient validation in OSIsValidName and unsafe...