Zabbix vulnerabilities
We track 29 vulnerabilities in Zabbix products across 7 products. 28 are rated high or critical, and 2 have been exploited in real attacks. The most recent was published on August 18, 2026.
Latest Zabbix vulnerabilities
- 7.8 High severity
Zabbix: Uncontrolled Search Path Element
When Zabbix Agent was installed on Windows into a custom installation directory, the installer did not verify whether the selected directory had secure access permissions. If the target directory allowed unauthorized users to modify its contents, an attacker c
- 9.1 Critical severity
Zabbix: Use of Hard-coded Password
In Zabbix 7.4 the cryptographic key used for signing Frontend sessions has been erroneously written to the database seed. Currently the only known exploitation scenario is for deployments that utilize both - SAML authentication and guest users. In such cases t
- 7.5 High severity
Zabbix: Asymmetric Resource Consumption (Amplification)
An unauthenticated user is able to cause disproportionate CPU load on the Frontend webserver by sending specifically crafted requests to the Frontend popup.testtriggerexpr action, leading to potential denial of service.
- 8.8 High severity
Zabbix: Improper Neutralization of Special Elements used in an SQL Command
A low privilege Zabbix user with API access can exploit a blind SQL injection vulnerability in include/classes/api/CApiService.php to execute arbitrary SQL selects via the sortfield parameter. Although query results are not returned directly, an attacker can e
- 8.8 High severity
Zabbix: Improper Neutralization of Special Elements used in an OS Command
Host and event action script input is validated with a regex (set by the administrator), but the validation runs in multiline mode. If ^ and $ anchors are used in user input validation, an injected newline lets authenticated users bypass the check and inject s
- 8.1 High severity
Zabbix: Incorrect Authorization
An authenticated Zabbix user (User role) with template/host write permissions is able to create objects via the configuration.import API. This can lead to confidentiality loss by creating unauthorized hosts. Note that the User role is normally not sufficient t
- 7.3 High severity
Zabbix: Uncontrolled Search Path Element
In Zabbix Agent and Agent 2 on Windows, the OpenSSL configuration file is loaded from a path writable by low-privileged users, allowing malicious modification and potential local privilege escalation by injecting a DLL.
- 7.3 High severity
Zabbix: Improper Neutralization of Special Elements used in an OS Command
Zabbix Agent 2 smartctl plugin does not properly sanitize smart.disk.get parameters, allowing an attacker to inject unexpected arguments into the smartctl command. In Zabbix 5.0 this allows for remote code execution.
- 8.8 High severity
Zabbix: Improper Neutralization of Special Elements used in an SQL Command
A low privilege (regular) Zabbix user with API access can use SQL injection vulnerability in include/classes/api/CApiService.php to execute arbitrary SQL commands via the groupBy parameter.
- 9.1 Critical severity
Zabbix: Use of Externally-Controlled Format String
The HttpRequest object allows to get the HTTP headers from the server's response after sending the request. The problem is that the returned strings are created directly from the data returned by the server and are not correctly encoded for JavaScript. This al
- 9.9 Critical severity
Zabbix: Improper Neutralization of Special Elements used in an SQL Command
A non-admin user account on the Zabbix frontend with the default User role, or with any other role that gives API access can exploit this vulnerability. An SQLi exists in the CUser class in the addRelatedObjects function, this function is being called from the
- 8.2 High severity
Zabbix: Stack-based Buffer Overflow
The reported vulnerability is a stack buffer overflow in the zbx_snmp_cache_handle_engineid function within the Zabbix server/proxy code. This issue occurs when copying data from session->securityEngineID to local_record.engineid without proper bounds checking
- 8.8 High severity
Zabbix: Improper Authorization
An authenticated user with API access (e.g.: user with default User role), more specifically a user with access to the user.update API endpoint is enough to be able to add themselves to any group (e.g.: Zabbix Administrators), except to groups that are disable
- 7.5 High severity
Zabbix: Allocation of Resources Without Limits or Throttling
Uncontrolled resource consumption refers to a software vulnerability where a attacker or system uses excessive resources, such as CPU, memory, or network bandwidth, without proper limitations or controls. This can cause a denial-of-service (DoS) attack or degr
- 9.1 Critical severity
Zabbix: Improper Neutralization of Special Elements used in a Command
Zabbix allows to configure SMS notifications. AT command injection occurs on "Zabbix Server" because there is no validation of "Number" field on Web nor on Zabbix server side. Attacker can run test of SMS providing specially crafted phone number and execute ad
- 7.2 High severity
Zabbix: Improper Control of Generation of Code
An administrator with restricted permissions can exploit the script execution functionality within the Monitoring Hosts section. The lack of default escaping for script parameters enabled this user ability to execute arbitrary code via the Ping script, thereby
- 8.8 High severity
Zabbix server can perform command execution for configured scripts.
Zabbix server can perform command execution for configured scripts. After command is executed, audit entry is added to "Audit Log". Due to "clientip" field is not sanitized, it is possible to injection SQL into "clientip" and exploit time based blind SQL injec
- 9.8 Critical severity
Zabbix: Improper Control of Generation of Code
The Zabbix Agent 2 item key smart.disk.get does not sanitize its parameters before passing them to a shell command resulting possible vulnerability for remote code execution.
- 7.2 High severity
An attacker who has the privilege to configure Zabbix items can use function icmpping() with…
An attacker who has the privilege to configure Zabbix items can use function icmpping() with additional malicious command inside it to execute arbitrary code on the current Zabbix server.
- 8.8 High severity
Zabbix: Reliance on Cookies without Validation and Integrity Checking
The website configured in the URL widget will receive a session cookie when testing or executing scheduled reports. The received session cookie can then be used to access the frontend as the particular user.
- 9.8 Critical severity
Zabbix: Improper Control of Generation of Code
Templates do not properly consider backticks (`) as Javascript string delimiters, and do not escape them as expected. Backticks are used, since ES6, for JS template literals. If a template contains a Go template action within a Javascript template literal, the
- 7.5 High severity
Zabbix: Improper Validation of Array Index
Duktape is an 3rd-party embeddable JavaScript engine, with a focus on portability and compact footprint. When adding too many values in valstack JavaScript will crash. This issue occurs due to bug in Duktape 2.6 which is an 3rd-party solution that we use.
- 7.5 High severity
Zabbix: Files or Directories Accessible to External Parties
JavaScript pre-processing can be used by the attacker to gain access to the file system (read-only access on behalf of user "zabbix") on the Zabbix Server or Zabbix Proxy, potentially leading to unauthorized access to sensitive data.
- 9.8 Critical severity
A Firewall Rule which allows all incoming TCP connections to all programs from any source and…
A Firewall Rule which allows all incoming TCP connections to all programs from any source and to all ports is created in Windows Firewall after Zabbix agent installation (MSI)
- 9.8 Critical severity
Frontend: Incorrect Authorization
Zabbix Frontend provides a feature that allows admins to maintain the installation and ensure that only certain IP addresses can access it. In this way, any user will not be able to access the Zabbix Frontend while it is being maintained and possible sensitive
- 5.3 Medium severity
Zabbix Frontend Improper Access Control Exploited
After the initial setup process, some steps of setup.php file are reachable not only by super-administrators, but by unauthenticated users as well. Malicious actor can pass step checks and potentially change the configuration of Zabbix Frontend.
- 7.3 High severity
Proxy, Server: Incorrect Permission Assignment for Critical Resource
During Zabbix installation from RPM, DAC_OVERRIDE SELinux capability is in use to access PID files in [/var/run/zabbix] folder. In this case, Zabbix Proxy or Server processes can bypass file read, write and execute permissions check on the file system level
- 9.8 Critical severity
Zabbix Frontend Authentication Bypass Exploited
In the case of instances where the SAML SSO authentication is enabled (non-default), session data can be modified by a malicious actor, because a user login stored in the session was not verified. Malicious unauthenticated actor may exploit this issue to escal
- 9.8 Critical severity
Zabbix-agent2: Missing Initialization of Resource
The zabbix-agent2 package before 5.4.9-r1 for Alpine Linux sometimes allows privilege escalation to root because the design incorrectly expected that systemd would (in effect) determine part of the configuration.