JavaScript Preprocessing Engine Vulnerability in Zabbix Server
CVE-2026-59782

6.9MEDIUM

Key Information:

Vendor

Zabbix

Status
Zabbix
Vendor
CVE Published:
5 October 2026

What is CVE-2026-59782?

A vulnerability exists in the JavaScript preprocessing engine (Duktape) on Zabbix Server, whereby limited administrators can access raw heap data. This exposure may lead to the leakage of sensitive information being processed by other active preprocessors, which the limited administrator shouldn't have permissions to access. Administrators must take precautions to safeguard against potential information disclosure resulting from this vulnerability. For more details, visit the reference link.

Affected Version(s)

Zabbix 6.0.0 <= 6.0.47

Zabbix 7.0.0 <= 7.0.28

Zabbix 7.4.0 <= 7.4.12

References

https://support.zabbix.com/browse/ZBX-28193

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Zabbix wants to thank Shaber Tseng for submitting this report on the HackerOne bug bounty platform.
.