CVE-2026-74038 is a path traversal vulnerability in Wazuh wazuh-manager affecting versions >=4.0.0 and <4.14.6. The vulnerability arises due to insufficient validation in the OS_IsValidName() function and unsafe path concatenation in delete_diff(), which allows an attacker to use a dot-sequence name (e.g., "..") during agent enrollment to traverse to the parent queue directory. This results in deletion of its subdirectories, causing denial of service by stopping all Wazuh services dependent on these directories.

An unauthenticated remote attacker can cause denial of service by deleting critical directories used by Wazuh services, leading to service disruption and requiring manual intervention to recover. There is no indication of code execution or data disclosure from the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the enrollment port and monitor for suspicious enrollment attempts with dot-sequence names. Manual recovery is required if the service is disrupted.