Denial of Service Vulnerability in Zabbix Frontend by an Unauthenticated User
CVE-2026-23930

5.3MEDIUM

Key Information:

Vendor

Zabbix

Status
Zabbix
Vendor
CVE Published:
18 August 2026

What is CVE-2026-23930?

An unauthenticated user can exploit a vulnerability in the Zabbix Frontend by sending specially crafted requests to the popup.testtriggerexpr action. This can lead to a significant increase in CPU load on the webserver, potentially resulting in service disruptions and denial of access for legitimate users.

Affected Version(s)

Zabbix 6.0.0 <= 6.0.46

Zabbix 7.0.0 <= 7.0.26

Zabbix 7.4.0 <= 7.4.10

References

https://support.zabbix.com/browse/ZBX-28069

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
Low
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Zabbix wants to thank barume for submitting this report on the HackerOne bug bounty platform.
.