ZDI-26-527: Wazuh Cluster DAPI Protocol Deserialization of Untrusted Data Remote Code Execution Vulnerability
ZDI discloses CVE-2026-44901, a 9.9-rated deserialization RCE in Wazuh cluster DAPI requiring low-privileged code on a worker node.
ZDI-26-527 describes a deserialization of untrusted data flaw in Wazuh's cluster DAPI protocol allowing network-adjacent attackers to execute arbitrary code. Exploitation requires the attacker to first obtain low-privileged code execution on a worker node. ZDI assigned a CVSS score of 9.9, and the flaw is tracked as CVE-2026-44901.
- CVSS 9.9 deserialization flaw in Wazuh cluster DAPI protocol
- Network-adjacent attackers can achieve remote code execution
- Requires prior low-privileged code execution on a worker node
- Tracked as CVE-2026-44901
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-44901 | Deserialization-of-Untrusted-Data RCE in Wazuh Cluster Distributed API | 8.4 | <1% | PoC |
From the original article
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Wazuh. An attacker must first obtain the ability to execute low-privileged code on a worker node in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 9.
zerodayinitiative.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.