SB2026081858 - Multiple vulnerabilities in Zabbix
Published: August 18, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 8 vulnerabilities.
1) Race condition (CVE-ID: CVE-2026-1199)
CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to perform more password guesses than intended.
The vulnerability exists due to a race condition in the login lockout mechanism in the frontend and api when processing simultaneous unsuccessful login requests. A remote attacker can send multiple concurrent login requests to perform more password guesses than intended.
2) Input validation error (CVE-ID: CVE-2026-23938)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to cause a denial of service.
The vulnerability exists due to improper input validation in JavaScript preprocessing or script items when processing specifically crafted JavaScript scripts. A remote privileged user can create specifically crafted preprocessing or script item JavaScript scripts to cause a denial of service.
The issue can crash the Zabbix server or proxy.
3) Improper access control (CVE-ID: CVE-2026-23937)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to disclose sensitive information.
The vulnerability exists due to improper access control in the host.get API action when handling crafted HTTP requests to the Zabbix API. A remote user can send crafted HTTP requests to extract a host's PSK key to disclose sensitive information.
Exploitation also requires access to the Zabbix trapper port.
4) Use-after-free (CVE-ID: CVE-2026-23935)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.8 [CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote privileged user to disclose sensitive information.
The vulnerability exists due to use-after-free in script item/preprocessing HttpRequest body logic when processing specifically crafted script items or JavaScript preprocessing scripts. A remote privileged user can create a specially crafted script item or JavaScript preprocessing script to disclose sensitive information.
The issue affects the server component.
5) Input validation error (CVE-ID: CVE-2026-23934)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 5.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to cause a denial of service.
The vulnerability exists due to improper input validation in the Frontend validate.api.exists action when handling crafted HTTP requests. A remote user can send specially crafted requests to cause a denial of service.
The issue can cause disproportionate CPU load on the Frontend webserver.
6) Use of Hard-coded Cryptographic Key (CVE-ID: CVE-2026-23933)
CWE-ID: CWE-321 - Use of Hard-coded Cryptographic Key
CVSSv4: 8.7 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to gain unauthorized access.
The vulnerability exists due to use of a hardcoded cryptographic key in frontend session signing when handling SAML authentication with guest users enabled. A remote attacker can forge valid session cookies to gain unauthorized access.
The only known exploitation scenario affects deployments that use both SAML authentication and guest users. Other deployments do not have a known impact.
7) Improper access control (CVE-ID: CVE-2026-23931)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to disclose sensitive information.
The vulnerability exists due to improper access control in the validate.api.exists action in the frontend when handling crafted HTTP requests. A remote user can send crafted HTTP requests to disclose sensitive information.
Plaintext user macro values can be extracted, while macro values of the 'Secret text' or 'Vault secret' types are not affected.
8) Input validation error (CVE-ID: CVE-2026-23930)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 5.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to improper input validation in the popup.testtriggerexpr action in the Frontend when handling crafted HTTP requests. A remote attacker can send specially crafted requests to cause a denial of service.
The issue can cause disproportionate CPU load on the Frontend webserver.
Remediation
Install update from vendor's website.
References
- https://support.zabbix.com/browse/ZBX-28076
- https://support.zabbix.com/browse/ZBX-28075
- https://support.zabbix.com/browse/ZBX-28074
- https://www.first.org/cvss/calculator/4-0#CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N
- https://support.zabbix.com/browse/ZBX-28073
- https://www.first.org/cvss/calculator/4-0#CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
- https://support.zabbix.com/browse/ZBX-28072
- https://support.zabbix.com/browse/ZBX-28071
- https://support.zabbix.com/browse/ZBX-28070
- https://support.zabbix.com/browse/ZBX-28069
- https://www.first.org/cvss/calculator/4-0#CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N