Zabbix

Vulnerability activity for Zabbix: what is being exploited, what was published lately, and when the next patch release is due.

All vendors Open in the dashboard

Last 30 days

CVEs: 0
Critical (CVSS 9+): 0
Exploited (CISA KEV): 0
With exploit code: 0

Last 90 days

CVEs: 17
Critical (CVSS 9+): 1
Exploited (CISA KEV): 0
With exploit code: 0

Last 365 days

CVEs: 28
Critical (CVSS 9+): 1
Exploited (CISA KEV): 0
With exploit code: 0

Exploited now

CVEs on CISA's known-exploited list, newest first. "Days to KEV" counts from the CVE's publication.

3.7LowJan 13, 2022Zabbix Frontend Auth bypass / access controlCVE-2022-23134Malicious actors can pass step checks and potentially change the configuration of Zabbix Frontend.Added to KEV Feb 22, 2022 · 39 days after publicationExploited95% likelyExploit codeNucleiDetection
9.1CriticalJan 13, 2022Zabbix Frontend Auth bypass / access controlCVE-2022-23131Unsafe client-side session storage leading to authentication bypass/instance takeover via Zabbix Frontend with configured SAML.Added to KEV Feb 22, 2022 · 39 days after publicationExploited96% likelyExploit codeNucleiDetection

Recent

5.7MediumOct 5, 2026Zabbix XSSCVE-2026-59788The email media type OAuth form passes the Authorization endpoint value to window.open() without validating the URL scheme, so a javascript: URL is executed in the browser. This means a crafted media type configuration, deliverable as an import file, runs arbitrary JavaScript as the Super Admin who grants consent.
5.3MediumOct 5, 2026ZabbixCVE-2026-59787The Perl SNMP trap receiver script shipped with Zabbix does not properly neutralize the ZBXTRAP record delimiter in trap content. This means someone able to send SNMP traps can inject a record targeting another host, resulting in a loss of integrity.
6.9MediumOct 5, 2026ZabbixCVE-2026-59786Zabbix Server and Proxy accept the active agent heartbeat message regardless of the configured PSK or certificate authentication. This means someone with access to the Zabbix trapper port can report an arbitrary host using an active agent as available, resulting in a loss of integrity.
5.1MediumOct 5, 2026ZabbixCVE-2026-59785Host search in Frontend allows filtering by fields that are not displayed, including stored IPMI and PSK credentials. A user with read access can guess a credential and see from the search result whether the guess was right, letting them uncover it.
2.3LowOct 5, 2026Zabbix Memory corruptionCVE-2026-59783The Zabbix Server/Proxy has a vulnerability where binary items can crash the Server/Proxy on certain NULL byte input leading to potential loss of availability. This only affects deployments where MySQL/MariaDB database is used as the Zabbix database.
6.9MediumOct 5, 2026Zabbix Memory corruptionCVE-2026-59782The JavaScript preprocessing (Duktape) engine on Zabbix server has a vulnerability where a limited administrator is able to read raw heap data potentially resulting in leaked data from other running preprocessors not available to said administrator.
7.8HighAug 18, 2026zabbix Privilege escalationCVE-2026-59781When Zabbix Agent was installed on Windows into a custom installation directory, the installer did not verify whether the selected directory had secure access permissions. If the target directory allowed unauthorized users to modify its contents, an attacker could place a malicious DLL that could later be loaded by the application, resulting in DLL sideloading. The installer has been hardened to detect potentially unsafe installation directories and now requires explicit user confirmation before
4.9MediumAug 18, 2026zabbix Denial of serviceCVE-2026-23938An authenticated administrator is able to crash Zabbix server or proxy by creating specifically crafted preprocessing/script item JavaScript scripts, leading to potential denial of service.
6.5MediumAug 18, 2026zabbix Information disclosureCVE-2026-23937The Zabbix API host.get action can be exploited by authenticated users to extract a host's PSK key leading to potential loss of data integrity.
4.9MediumAug 18, 2026zabbix Memory corruptionCVE-2026-23935A Zabbix administrator is able to read out of bounds memory by utilizing a flaw in script item/preprocessing (JavaScript) HttpRequest logic, leading to potential confidentiality loss.
6.5MediumAug 18, 2026zabbix Denial of serviceCVE-2026-23934An authenticated user is able to cause disproportionate CPU load on the Frontend webserver by sending specifically crafted requests to the Frontend validate.api.exists action, leading to potential denial of service.
9.1CriticalAug 18, 2026zabbix Crypto / certificateCVE-2026-23933In Zabbix 7.4 the cryptographic key used for signing Frontend sessions has been erroneously written to the database seed. Currently the only known exploitation scenario is for deployments that utilize both - SAML authentication and guest users. In such cases the key can be used to forge valid session cookies, potentially leading to unauthorized access. For other Zabbix deployments this does not have a known impact.
4.3MediumAug 18, 2026zabbix Information disclosureCVE-2026-23931The frontend validatate.api.exists action can be exploited by authenticated users to extract plaintext user macro values leading to potential loss of confidentiality.
7.5HighAug 18, 2026zabbix Denial of serviceCVE-2026-23930An unauthenticated user is able to cause disproportionate CPU load on the Frontend webserver by sending specifically crafted requests to the Frontend popup.testtriggerexpr action, leading to potential denial of service.
5.4MediumAug 18, 2026zabbix XSSCVE-2026-23929Prototype pollution vulnerability in searchParamsToObject() is leading to a persistent XSS in Maps. URL parameter processing was not filtering dangerous properties like __proto__, combined with jQuery's unsafe element creation that traversed the prototype chain.
4.9MediumAug 18, 2026zabbixCVE-2026-23922The email media OAuth field 'Client secret' cannot be read after saving, but a Super Admin can leak it by setting a malicious 'Token endpoint'. Changes were made to reset the client secret upon changing the token endpoint.
3.7LowAug 18, 2026zabbixCVE-2026-1199Zabbix API and Frontend login lockout mechanism has a flaw where several unsuccessful login requests are not properly counted towards the block counter if sent simultaneously, potentially allowing for more password guesses than intended.
6.8MediumMay 6, 2026zabbix XSSCVE-2026-23928The Item history widget (in Zabbix 7.0+) or the Plain text widget (in Zabbix 6.0) can execute injected JavaScript when HTML display is enabled. This can allow an attacker to perform unauthorized actions depending on which user opens a dashboard containing these widgets. The malicious JavaScript would have to come from a monitored host controlled by the attacker. Note: the Item history widget is a replacement for the Plain text widget since Zabbix 7.0.
6.5MediumMay 6, 2026zabbixCVE-2026-23927A user able to connect to Agent 2 can inject an Oracle TNS connection string via the 'service' parameter. This can lead to Agent 2 connecting to an attacker-controlled server and leaking Oracle database credentials if they are saved in a named session.
6.8MediumMay 6, 2026zabbix XSSCVE-2026-23926An authenticated (non-super) administrator can create a maintenance period with a JavaScript payload that is executed by any user that opens tooltip for that maintenance period in the Host navigator widget. This can allow the attacker to perform unauthorized actions depending on which user opens the tooltip.
4.9MediumMar 24, 2026zabbix Code / command injectionCVE-2026-23924Zabbix Agent 2 Docker plugin does not properly sanitize the 'docker.container_info' parameters when forwarding them to the Docker daemon. An attacker capable of invoking Agent 2 can read arbitrary files from running Docker containers by injecting them via the Docker archive API.
5.3MediumMar 24, 2026zabbixCVE-2026-23923An unauthenticated attacker can exploit the Frontend 'validate' action to blindly instantiate arbitrary PHP classes. The impact depends on environment setup but appears limited at this time.
8.8HighMar 24, 2026zabbix SQL injectionCVE-2026-23921A low privilege Zabbix user with API access can exploit a blind SQL injection vulnerability in include/classes/api/CApiService.php to execute arbitrary SQL selects via the sortfield parameter. Although query results are not returned directly, an attacker can exfiltrate arbitrary database data through time-based techniques, potentially leading to session identifier disclosure and administrator account compromise.
8.8HighMar 24, 2026zabbix Code / command injectionCVE-2026-23920Host and event action script input is validated with a regex (set by the administrator), but the validation runs in multiline mode. If ^ and $ anchors are used in user input validation, an injected newline lets authenticated users bypass the check and inject shell commands.
6.0MediumMar 24, 2026zabbixCVE-2026-23919For performance reasons Zabbix Server/Proxy reuses JavaScript (Duktape) contexts (used in script items, JavaScript reprocessing, Webhooks). This can lead to confidentiality loss where a regular (non-super) Zabbix administrator leaks data for hosts they do not have access to. A fix has been released that makes the built in Zabbix JavaScript objects read-only, but please be advised that usage of global JavaScript variables is not recommended because their content could be leaked. More information
8.1HighMar 6, 2026zabbix Auth bypass / access controlCVE-2026-23925An authenticated Zabbix user (User role) with template/host write permissions is able to create objects via the configuration.import API. This can lead to confidentiality loss by creating unauthorized hosts. Note that the User role is normally not sufficient to create and edit templates/hosts even with write permissions.
6.5MediumDec 1, 2025Zabbix frontend Denial of serviceCVE-2025-49643An authenticated Zabbix user (including Guest) is able to cause disproportionate CPU load on the webserver by sending specially crafted parameters to /imgstore.php, leading to potential denial of service.
4.9MediumDec 1, 2025Zabbix frontend SSRFCVE-2025-27232An authenticated Zabbix Super Admin can exploit the oauth.authorize action to read arbitrary files from the webserver leading to potential confidentiality loss.
3.7LowJan 13, 2022Zabbix Frontend Auth bypass / access controlCVE-2022-23134Malicious actors can pass step checks and potentially change the configuration of Zabbix Frontend.Exploited95% likelyExploit codeNucleiDetection
9.1CriticalJan 13, 2022Zabbix Frontend Auth bypass / access controlCVE-2022-23131Unsafe client-side session storage leading to authentication bypass/instance takeover via Zabbix Frontend with configured SAML.Exploited96% likelyExploit codeNucleiDetection

See every Zabbix entry on the dashboard.