Wazuh and AI For Enhanced SOC Workflows
Wazuh details AI-powered SOC workflows via its AI Analyst, self-hosted Llama 3 via Ollama, and Claude 3.5 Haiku integrations.
Wazuh outlines how AI can augment SOC analysts handling high alert volumes. The Wazuh AI Analyst on Wazuh Cloud uses Amazon Bedrock and Anthropic Claude to generate scheduled security posture reports. Self-hosted options include Llama 3 with Ollama, FAISS, and LangChain for privacy-sensitive threat hunting, plus an OpenSearch Assistant integration with Claude 3.5 Haiku. This is a vendor-contributed piece describing product capabilities rather than an incident or vulnerability.
ZDI-26-528: Wazuh Cluster DAPI Protocol Deserialization of Untrusted Data Remote Code Execution Vulnerability
ZDI advisory ZDI-26-528 discloses CVE-2026-28220, a CVSS 9.9 deserialization RCE in Wazuh's cluster DAPI protocol exploitable by network-adjacent attackers.
Wazuh contains a deserialization-of-untrusted-data flaw in its cluster DAPI protocol, tracked as CVE-2026-28220 with CVSS 9.9. Network-adjacent attackers can execute arbitrary code on affected installations, but must first obtain the ability to execute low-privileged code on a worker node. The vulnerability was disclosed through ZDI advisory ZDI-26-528.
ZDI-26-527: Wazuh Cluster DAPI Protocol Deserialization of Untrusted Data Remote Code Execution Vulnerability
ZDI discloses CVE-2026-44901, a 9.9-rated deserialization RCE in Wazuh cluster DAPI requiring low-privileged code on a worker node.
ZDI-26-527 describes a deserialization of untrusted data flaw in Wazuh's cluster DAPI protocol allowing network-adjacent attackers to execute arbitrary code. Exploitation requires the attacker to first obtain low-privileged code execution on a worker node. ZDI assigned a CVSS score of 9.9, and the flaw is tracked as CVE-2026-44901.