Unauthenticated PHP Class Instantiation Vulnerability in Zabbix
CVE-2026-23923

6.9MEDIUM

Key Information:

Vendor

Zabbix

Status
Zabbix
Vendor
CVE Published:
24 March 2026

What is CVE-2026-23923?

This vulnerability allows unauthenticated attackers to exploit the Frontend 'validate' action in Zabbix, leading to the potential for blind instantiation of arbitrary PHP classes. The extent of the impact depends on the specific environment configuration, but current assessments suggest the risks may be contained if proper security measures are implemented.

Affected Version(s)

Zabbix 7.4.0 <= 7.4.6

References

https://support.zabbix.com/browse/ZBX-27641

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Zabbix wants to thank pitticus for submitting this report on the HackerOne bug bounty platform.
.