NLShown in its original language — a full translation is planned for a future version.
Kwetsbaarheden verholpen in Zabbix
view advisory published 2026-08-20
Zabbix SIA heeft meerdere kwetsbaarheden verholpen in Zabbix, inclusief de API, Frontend, script item en preprocessing componenten, en de Windows Agent installer.
01
describes (11)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-59781US | high7.8 | — | ||
When Zabbix Agent was installed on Windows into a custom installation directory, the installer did not verify whether the selected directory had secure access permissions. If the t… | ||||
| CVE-2026-23938US | medium4.9 | — | ||
An authenticated administrator is able to crash Zabbix server or proxy by creating specifically crafted preprocessing/script item JavaScript scripts, leading to potential denial of… | ||||
| CVE-2026-23937US | medium6.5 | — | ||
The Zabbix API host.get action can be exploited by authenticated users to extract a host's PSK key leading to potential loss of data integrity. | ||||
| CVE-2026-23935US | medium4.9 | — | ||
A Zabbix administrator is able to read out of bounds memory by utilizing a flaw in script item/preprocessing (JavaScript) HttpRequest logic, leading to potential confidentiality lo… | ||||
| CVE-2026-23934US | medium6.5 | — | ||
An authenticated user is able to cause disproportionate CPU load on the Frontend webserver by sending specifically crafted requests to the Frontend validate.api.exists action, lead… | ||||
| CVE-2026-23933US | critical9.1OT elevated | — | ||
In Zabbix 7.4 the cryptographic key used for signing Frontend sessions has been erroneously written to the database seed. Currently the only known exploitation scenario is for depl… | ||||
| CVE-2026-23931US | medium4.3 | — | ||
The frontend validatate.api.exists action can be exploited by authenticated users to extract plaintext user macro values leading to potential loss of confidentiality. | ||||
| CVE-2026-23930US | high7.5 | — | ||
An unauthenticated user is able to cause disproportionate CPU load on the Frontend webserver by sending specifically crafted requests to the Frontend popup.testtriggerexpr action,… | ||||
| CVE-2026-23929US | medium5.4 | — | ||
Prototype pollution vulnerability in searchParamsToObject() is leading to a persistent XSS in Maps. URL parameter processing was not filtering dangerous properties like __proto__,… | ||||
| CVE-2026-23922US | medium4.9 | — | ||
The email media OAuth field 'Client secret' cannot be read after saving, but a Super Admin can leak it by setting a malicious 'Token endpoint'. Changes were made to reset the clien… | ||||
| CVE-2026-1199US | low3.7 | — | ||
Zabbix API and Frontend login lockout mechanism has a flaw where several unsuccessful login requests are not properly counted towards the block counter if sent simultaneously, pote… | ||||
02
references
External citations — patches, advisories, analysis.
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan