PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-23925 Zabbix CVE debrief

CVE-2026-23925 is a medium-severity vulnerability in Zabbix that allows an authenticated user with template/host write permissions to create unauthorized hosts, potentially leading to confidentiality loss. The vulnerability has a CVSS score of 5.1 and was published on March 6, 2026.

Vendor
Zabbix
Product
Unknown
CVSS
MEDIUM 5.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-03-06
Original CVE updated
2026-06-05
Advisory published
2026-03-06
Advisory updated
2026-06-05

Who should care

Users of Zabbix, especially those with User role and template/host write permissions, should be aware of this vulnerability and take necessary actions to mitigate it.

Technical summary

An authenticated Zabbix user (User role) with template/host write permissions can create objects via the configuration.import API, leading to confidentiality loss by creating unauthorized hosts.

Defensive priority

MEDIUM

Recommended defensive actions

  • Apply patches or updates provided by Zabbix to fix the vulnerability.
  • Restrict template/host write permissions to authorized users only.
  • Monitor Zabbix systems for suspicious activity.

Evidence notes

The vulnerability is confirmed by the Zabbix vendor and has been analyzed by the National Vulnerability Database (NVD).

Official resources

CVE-2026-23925 was published on March 6, 2026, and modified on June 5, 2026.