SQL Injection Vulnerability in Zabbix API by Zabbix

CVE-2026-23921

What is CVE-2026-23921?

CVE-2026-23921 refers to a SQL injection vulnerability present in the Zabbix API, affecting the Zabbix monitoring solution widely used for network performance and availability management. This vulnerability arises from insufficient validation in the API's handling of input parameters, specifically within the CApiService.php file. A low-privileged Zabbix user with API access can exploit this weakness to perform blind SQL injection attacks through the sortfield parameter. Although the results of the executed SQL queries are not directly returned, an attacker can use time-based techniques to infer information, potentially allowing for the exfiltration of sensitive database data, which could lead to critical security breaches such as session identifier disclosure or even the compromise of administrator accounts. As Zabbix is integral to operational monitoring and alerting in organizations, this vulnerability poses a severe risk that could disrupt services or lead to unauthorized access to sensitive information.

Potential impact of CVE-2026-23921

1. Data Exfiltration: Attackers can exploit the vulnerability to extract databases' sensitive information over time, risking the integrity and confidentiality of critical organizational data.

2. Session Hijacking: Exploiting this vulnerability could allow attackers to disclose session identifiers, potentially enabling them to hijack active sessions and impersonate legitimate users, including administrators.

3. Administrative Account Compromise: The vulnerability could ultimately lead to unauthorized access to administrative accounts, which could be used to manipulate system settings, monitor traffic, and further compromise the infrastructure.

References