Denial of Service Vulnerability in Zabbix Frontend Webserver
CVE-2026-23934

5.1MEDIUM

Key Information:

Vendor

Zabbix

Status
Zabbix
Vendor
CVE Published:
18 August 2026

What is CVE-2026-23934?

An authenticated user can exploit a flaw in the Zabbix Frontend by sending specifically crafted requests to the validate.api.exists action, which leads to an overwhelming CPU load on the webserver. This can disrupt service availability and impact the performance of the application, making it crucial for administrators to monitor and mitigate this risk.

Affected Version(s)

Zabbix 7.4.0 <= 7.4.11

References

https://support.zabbix.com/browse/ZBX-28072

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
Low
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Zabbix wants to thank kang999 for submitting this report on the HackerOne bug bounty platform.
.