ZDI-26-528: Wazuh Cluster DAPI Protocol Deserialization of Untrusted Data Remote Code Execution Vulnerability
ZDI advisory ZDI-26-528 discloses CVE-2026-28220, a CVSS 9.9 deserialization RCE in Wazuh's cluster DAPI protocol exploitable by network-adjacent attackers.
Wazuh contains a deserialization-of-untrusted-data flaw in its cluster DAPI protocol, tracked as CVE-2026-28220 with CVSS 9.9. Network-adjacent attackers can execute arbitrary code on affected installations, but must first obtain the ability to execute low-privileged code on a worker node. The vulnerability was disclosed through ZDI advisory ZDI-26-528.
- Deserialization flaw in Wazuh cluster DAPI protocol, CVE-2026-28220, CVSS 9.9
- Network-adjacent RCE requires prior low-privileged code execution on a worker node
- Wazuh is widely deployed open-source security monitoring platform
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-28220 | Wazuh: Issues in the Cluster Distributed API (DAPI) handling allow a cluster peer, or any actor able to authenticate to the cluster… | 9.1 | <1% | PoC |
From the original article
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Wazuh. An attacker must first obtain the ability to execute low-privileged code on a worker node in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 9.
zerodayinitiative.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.