Is CVE-2026-74031 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-74031 being exploited in the wild.

How severe is CVE-2026-74031?

Medium severity, with a CVSS score of 6.5, published 13 October 2026.

Is there a fix for CVE-2026-74031?

Yes: fixed in 4.14.8. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-74031 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-74031?

Check whether you run Wazuh Manager at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-74031: Wazuh path traversal in rule and decoder deletion helpers

CVE-2026-74031 · Severity: medium · CVSS 6.5 · Published 2026-10-13

Wazuh, a security monitoring and threat detection platform, contains a path traversal vulnerability in its rule and decoder file deletion functions. An attacker with access to the cluster key can exploit this to delete arbitrary files on the manager system, including critical configuration files (ossec.conf, client.keys) or detection rules, causing service disruption or authentication failure. This requires prior access to the cluster key, limiting immediate risk but creating a severe impact for compromised cluster workers.

Technologies: Wazuh Manager. Vendors: Wazuh.

Quick answers

Is CVE-2026-74031 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-74031 being exploited in the wild.
How severe is CVE-2026-74031?: Medium severity, with a CVSS score of 6.5, published 13 October 2026.
Which products and versions are affected?: Wazuh Manager 4.1.1 to 4.14.7.
Is there a fix for CVE-2026-74031?: Yes: fixed in 4.14.8. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-74031 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-74031?: Check whether you run Wazuh Manager at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 4.14.8

Technical details

The delete_rule_file and delete_decoder_file helpers in wazuh/rule.py and wazuh/decoder.py construct file paths from unvalidated filename parameters and call remove() directly without path normalization or traversal checks. These helpers are exposed via the DistributedAPI cluster callable mechanism, allowing a malicious cluster worker to invoke them with crafted filenames containing traversal sequences (e.g., ../../../../etc/ossec.conf) to delete files outside the intended directory. The vulnerability affects versions 4.1.1 through 4.14.7 and is fixed in 4.14.8 by adding destination path validation.

Affected products

Wazuh Wazuh Manager 4.1.1 to 4.14.7

Timeline

2026-10-13: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.