ZDI 2026-08-11

ZDI-26-528: Wazuh Cluster DAPI Protocol Deserialization of Untrusted Data Remote Code Execution Vulnerability

CVE-2026-28220

Machine-generated analysis · WAYSCloud LLM

Exploitation requires prior low-privileged code execution on a Wazuh worker node. The flaw is a deserialization of untrusted data in the Cluster DAPI protocol.

Context

The advisory concerns the Wazuh Cluster DAPI protocol. It contains a deserialization of untrusted data that can lead to remote code execution. Network-adjacent attackers can trigger the exploit after obtaining low-privileged execution on a worker node.

Operator considerations

Check: Verify the Wazuh cluster DAPI protocol version on each node.
Isolate: Isolate any worker node where low-privileged code execution has been observed until remediation.

From Zero Day Initiative ↗

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Wazuh. An attacker must first obtain the ability to execute low-privileged code on a worker node in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 9.9. The following CVEs are assigned: CVE-2026-28220.

Read the full advisory on ZDI →