Zabbix vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Exploited Zabbix flaws

These are on CISA’s Known Exploited Vulnerabilities list, newest first. If you run any of these products, these come before everything else.

• CVE-2022-23134 Zabbix Frontend Improper Access ControlExploited since Feb 22, 2022 · CVSS 3.7
• CVE-2022-23131 Zabbix Frontend Authentication BypassExploited since Feb 22, 2022 · CVSS 9.1

Latest high and critical flaws

• CVE-2026-23933 In Zabbix 7.4 the cryptographic key used for signing Frontend sessions has been erroneously written to the database seed.High 7.7 · Aug 18, 2026
• CVE-2026-23929 Prototype pollution vulnerability in searchParamsToObject() is leading to a persistent XSS in Maps.High 8.5 · Aug 18, 2026
• CVE-2026-23928 The Item history widget (in Zabbix 7.0+) or the Plain text widget (in Zabbix 6.0) can execute injected JavaScript when HTML display is enabled.High 7.3 · May 6, 2026
• CVE-2026-23926 An authenticated (non-super) administrator can create a maintenance period with a JavaScript payload that is executed by any user that opens tooltip for that maHigh 7.3 · May 6, 2026
• CVE-2026-23921 A low privilege Zabbix user with API access can exploit a blind SQL injection vulnerability in include/classes/api/CApiService.php to execute arbitrary SQL seleHigh 8.7 · Mar 24, 2026
• CVE-2026-23920 Host and event action script input is validated with a regex (set by the administrator), but the validation runs in multiline mode.High 7.7 · Mar 24, 2026
• CVE-2026-23919 For performance reasons Zabbix Server/Proxy reuses JavaScript (Duktape) contexts (used in script items, JavaScript reprocessing, Webhooks).High 7.1 · Mar 24, 2026
• CVE-2025-27237 In Zabbix Agent and Agent 2 on Windows, the OpenSSL configuration file is loaded from a path writable by low-privileged users, allowing malicious modification aHigh 7.3 · Oct 3, 2025
• CVE-2025-27240 A Zabbix adminitrator can inject arbitrary SQL during the autoremoval of hosts by inserting malicious SQL in the 'Visible name' field.High 7.5 · Sep 12, 2025
• CVE-2025-27234 Zabbix Agent 2 smartctl plugin does not properly sanitize smart.disk.get parameters, allowing an attacker to inject unexpected arguments into the smartctl commaHigh 7.3 · Sep 12, 2025
• CVE-2024-45699 The endpoint /zabbix.php?action=export.valuemaps suffers from a Cross-Site Scripting vulnerability via the backurl parameter.High 7.5 · Apr 2, 2025
• CVE-2024-36465 A low privilege (regular) Zabbix user with API access can use SQL injection vulnerability in include/classes/api/CApiService.php to execute arbitrary SQL commanHigh 8.6 · Apr 2, 2025
• CVE-2024-36466 A bug in the code allows an attacker to sign a forged zbx_session cookie, which then allows them to sign in with admin permissions.High 8.8 · Nov 28, 2024
• CVE-2024-42330 The HttpRequest object allows to get the HTTP headers from the server's response after sending the request.Critical 9.1 · Nov 27, 2024
• CVE-2024-42327 A non-admin user account on the Zabbix frontend with the default User role, or with any other role that gives API access can exploit this vulnerability.Critical 9.9 · Nov 27, 2024
• CVE-2024-36467 An authenticated user with API access (e.g.: user with default User role), more specifically a user with access to the user.update API endpoint is enough to be High 7.5 · Nov 27, 2024
• CVE-2024-36462 Uncontrolled resource consumption refers to a software vulnerability where a attacker or system uses excessive resources, such as CPU, memory, or network bandwiHigh 7.5 · Aug 12, 2024
• CVE-2024-36461 Within Zabbix, users have the ability to directly modify memory pointers in the JavaScript engine.Critical 9.1 · Aug 12, 2024
• CVE-2024-36460 The front-end audit log allows viewing of unprotected plaintext passwords, where the passwords are displayed in plain text.High 8.1 · Aug 12, 2024
• CVE-2024-22116 An administrator with restricted permissions can exploit the script execution functionality within the Monitoring Hosts section.Critical 9.9 · Aug 12, 2024
• CVE-2024-22120 Zabbix server can perform command execution for configured scripts.Critical 9.1 · May 17, 2024
• CVE-2023-32725 The website configured in the URL widget will receive a session cookie when testing or executing scheduled reports.Critical 9.6 · Dec 18, 2023
• CVE-2023-32724 Memory pointer is in a property of the Ducktape object.Critical 9.1 · Oct 12, 2023
• CVE-2023-32723 Request to LDAP is sent before user permissions are checked.High 8.5 · Oct 12, 2023
• CVE-2023-32722 The zabbix/src/libs/zbxjson module is vulnerable to a buffer overflow when parsing JSON files via zbx_json_open.Critical 9.6 · Oct 12, 2023