NCSC-2026-0320 [1.00] [M/H] Kwetsbaarheden verholpen in Zabbix
Zabbix SIA heeft meerdere kwetsbaarheden verholpen in Zabbix, inclusief de API, Frontend, script item en preprocessing componenten, en de Windows Agent installer. De kwetsbaarheden betreffen verschillende onderdelen van Zabbix. - Een probleem in het login lockout mechanisme zorgt ervoor dat meerdere gelijktijdige mislukte inlogpogingen niet correct worden geteld, waardoor een aanvaller de lockout kan omzeilen en meer wachtwoordpogingen kan doen dan bedoeld. - In de OAuth-configuratie voor e-mailmedia kan een Super Admin via aanpassingen aan de 'Token endpoint' het client secret onthullen en wijzigen. - Prototype pollution in de searchParamsToObject() functie leidt tot persistente cross-site scripting (XSS) via onveilige URL-parameterverwerking en jQuery elementcreatie. - De Frontend webserver bevat een actie (popup.testtriggerexpr) die door niet-geauthenticeerde gebruikers kan worden misbruikt om een denial of service (DoS) te veroorzaken door overmatige CPU-belasting. - Geauthenticeerde gebruikers kunnen via de validate.api.exists actie plaintext user macro waarden uitlezen, wat gevoelige informatie blootlegt. In Zabbix 7.4 is een cryptografische sleutel voor het ondertekenen van Frontend sessies onjuist opgeslagen in de database seed, waardoor sessiecookies kunnen worden vervalst bij gebruik van SAML authenticatie en gastgebruikers. De validate.api.exists actie kan ook leiden tot DoS door excessief CPU-gebruik bij speciaal samengestelde verzoeken. - In de script item en preprocessing JavaScript HttpRequest logica kan een administrator geheugen buiten de bedoelde grenzen uitlezen, wat kan leiden tot informatielekken. - De API host.get actie maakt het mogelijk voor geauthenticeerde gebruikers om de pre-shared key (PSK) van een host te achterhalen, wat de vertrouwelijkheid en integriteit van gegevens ondermijnt. - Een authenticeerde administrator kan via speciaal samengestelde JavaScript scripts in preprocessing of script items een DoS veroorzaken door server- of pro
CSIRTS triage
- What
- Multiple vulnerabilities in Zabbix components including a broken login lockout mechanism, OAuth client secret exposure, prototype pollution leading to XSS, and unauthenticated DoS via popup.testtriggerexpr action.
- Who is affected
- Zabbix deployments using affected API, Frontend, script item, preprocessing, and Windows Agent components.
- Urgency
- Medium to high priority; multiple attack vectors including authentication bypass and DoS affect availability and confidentiality.
- Action
- Apply Zabbix security updates to resolve CVE-2026-1199, CVE-2026-23922, CVE-2026-23929, CVE-2026-23930, CVE-2026-23931, CVE-2026-23933, CVE-2026-23934, and CVE-2026-23935.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch Zabbix
Get an email when a new Zabbix advisory drops — max one per day, one-click unsubscribe.
Details
Original advisory: https://advisories.ncsc.nl/advisory?id=NCSC-2026-0320
Exploitation outlook
EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.
- Low exploitation riskCVE-2026-11990.16% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 5% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-239220.27% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 20% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-239290.18% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 8% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-239300.36% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 29% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-239310.28% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 20% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-239330.20% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 10% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-239340.17% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 6% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-239350.18% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 7% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-239370.28% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 20% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-239380.30% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 22% of all EPSS-scored CVEs.
Referenced CVEs
| CVE | CSIRTS overview | External |
|---|---|---|
| CVE-2026-1199 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-23922 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-23929 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-23930 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-23931 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-23933 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-23934 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-23935 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-23937 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-23938 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-59781 | coverage & exploitation status | NVD · CVE.org |
Same CVEs, other sources
How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.
- unknownZabbix agent may insecurely load Dynamic Link Librariesjvn
- high[NEW] [high] Zabbix: Multiple vulnerabilitiescert-bund
- unknownCVE-2026-59781: When Zabbix Agent was installed on Windows into a custom installation directory, the installer…nvd
- unknownCVE-2026-23938: An authenticated administrator is able to crash Zabbix server or proxy by creating specificall…nvd
- unknownCVE-2026-23937: The Zabbix API host.get action can be exploited by authenticated users to extract a host's PSK…nvd
- unknownCVE-2026-23935: A Zabbix administrator is able to read out of bounds memory by utilizing a flaw in script item…nvd
- unknownCVE-2026-23934: An authenticated user is able to cause disproportionate CPU load on the Frontend webserver by …nvd
- unknownCVE-2026-23933: In Zabbix 7.4 the cryptographic key used for signing Frontend sessions has been erroneously wr…nvd
- unknownCVE-2026-23931: The frontend validatate.api.exists action can be exploited by authenticated users to extract p…nvd
- unknownCVE-2026-23930: An unauthenticated user is able to cause disproportionate CPU load on the Frontend webserver b…nvd
- unknownCVE-2026-23929: Prototype pollution vulnerability in searchParamsToObject() is leading to a persistent XSS in …nvd
- unknownCVE-2026-23922: The email media OAuth field 'Client secret' cannot be read after saving, but a Super Admin can…nvd
Recent advisories for Kwetsbaarheden verholpen in
A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.
- unknownNCSC-2026-0347 [1.01] [M/H] Kwetsbaarheden verholpen in Microsoft Azurencsc-nl · 2026-09-14
- unknownexploitedNCSC-2026-0076 [1.03] [H/H] Kwetsbaarheden verholpen in Cisco Secure Firewall Management Centerncsc-nl · 2026-09-12
- unknownexploitedNCSC-2026-0076 [1.02] [H/H] Kwetsbaarheden verholpen in Cisco Secure Firewall Management Centerncsc-nl · 2026-09-11
- unknownNCSC-2026-0366 [1.00] [M/H] Kwetsbaarheden verholpen in Arista EOSncsc-nl · 2026-09-11
- unknownNCSC-2026-0365 [1.00] [H/H] Kwetsbaarheden verholpen in Check Point VPN productenncsc-nl · 2026-09-10
- unknownNCSC-2026-0364 [1.00] [M/H] Kwetsbaarheden verholpen in Adobe Illustratorncsc-nl · 2026-09-09
More from NCSC-NL Advisories
- unknownNCSC-2026-0347 [1.01] [M/H] Kwetsbaarheden verholpen in Microsoft Azure2026-09-14
- unknownNCSC-2026-0076 [1.03] [H/H] Kwetsbaarheden verholpen in Cisco Secure Firewall Management Center2026-09-12
- unknownNCSC-2026-0367 [1.00] [H/H] Kwetsbaarheid verholpen in GitLab Community en Enterprise Editions2026-09-12
- unknownNCSC-2026-0271 [1.01] [M/H] Kwetsbaarheid verholpen in Cisco Secure Firewall Management Center2026-09-11
- unknownNCSC-2026-0076 [1.02] [H/H] Kwetsbaarheden verholpen in Cisco Secure Firewall Management Center2026-09-11