Local Privilege Escalation in Zabbix Agent on Windows

CVE-2025-27237

What is CVE-2025-27237?

The Zabbix Agent and Agent 2 on Windows are susceptible to a vulnerability that allows low-privileged users to alter the OpenSSL configuration file. Because this file is located in a writable path, malicious actors can inject a Dynamic Link Library (DLL), leading to potential environment compromise and local privilege escalation. Organizations using these products should assess their configurations and apply recommended security practices to mitigate the risks associated with this flaw.

References