CVE-2026-23926 Zabbix CVE debrief

Who should care

Defenders and administrators of Zabbix systems, especially those with multiple users and critical infrastructure, should assess exposure and prioritize mitigation to prevent potential unauthorized actions. This includes verifying affected versions and system exposure, and implementing additional security measures to prevent JavaScript payload execution.

Why it matters

This vulnerability allows authenticated users to create maintenance periods with JavaScript payloads, potentially leading to unauthorized actions and privilege escalation. Defenders should prioritize verification, mitigation, and timely patching to prevent exploitation.

• Potential unauthorized actions by attackers through JavaScript payload execution.
• Possible privilege escalation through exploitation of this vulnerability.
• Required verification of affected versions and system exposure.
• Necessity for timely patching or mitigation to prevent exploitation.

Technical summary

An authenticated, non-super administrator can create a maintenance period with a JavaScript payload that is executed by any user opening the tooltip for that maintenance period in the Host navigator widget. This vulnerability affects Zabbix systems, particularly those with multiple users and critical infrastructure. The vulnerability allows attackers to perform unauthorized actions depending on which user opens the tooltip. Defenders should prioritize verifying and mitigating this vulnerability, especially in systems where unauthorized actions could have significant impacts.

Defensive priority

Defenders should prioritize verifying and mitigating this vulnerability, especially in systems where unauthorized actions could have significant impacts.

Recommended defensive actions

• Verify and apply patches for Zabbix versions 7.0.0 to 7.0.24 and 7.4.0 to 7.4.8.
• Restrict maintenance period creation to super administrators.
• Monitor for suspicious maintenance period creations and unauthorized actions.
• Implement additional security measures to prevent JavaScript payload execution.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and NVD detail page provide information about this vulnerability, including its CVSS score and affected versions. The vulnerability is confirmed in Zabbix versions 7.0.0 to 7.0.24 and 7.4.0 to 7.4.8. Defenders should verify affected versions and system exposure, and prioritize timely patching or mitigation to prevent exploitation. The CVE Program and NVD detail page serve as official sources for this vulnerability information.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.