Denial of Service Vulnerability in Zabbix Server and Proxy by Zabbix
CVE-2026-23938

2.1LOW

Key Information:

Vendor

Zabbix

Status
Zabbix
Vendor
CVE Published:
18 August 2026

What is CVE-2026-23938?

An authenticated administrator can trigger a denial of service in Zabbix server or proxy through the execution of specially crafted JavaScript scripts in preprocessing or script items. This vulnerability results in the server or proxy crashing, potentially leading to significant downtime and service disruption.

Affected Version(s)

Zabbix 6.0.0 <= 6.0.46

Zabbix 7.0.0 <= 7.0.26

Zabbix 7.4.0 <= 7.4.10

References

https://support.zabbix.com/browse/ZBX-28075

CVSS V4

Score:
2.1
Severity:
LOW
Confidentiality:
None
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Zabbix wants to thank mjlx for submitting this report on the HackerOne bug bounty platform.
.