NCSC-2026-0320 [1.00] [M/H] Vulnerabilities resolved in Zabbix
Zabbix SIA has resolved multiple vulnerabilities in Zabbix, including the API, Frontend, script item and preprocessing components, and the Windows Agent installer. The vulnerabilities affect various components of Zabbix. - An issue in the login lockout mechanism causes multiple simultaneous failed login attempts to not be counted correctly, allowing an attacker to bypass the lockout and make more password attempts than intended. - In the OAuth configuration for email media, a Super Admin can reveal and modify the client secret through modifications to the 'Token endpoint'. - Prototype pollution in the searchParamsToObject() function leads to persistent cross-site scripting (XSS) via unsafe URL parameter processing and jQuery element creation. - The Frontend webserver contains an action (popup.testtriggerexpr) that can be misused by unauthenticated users to cause a denial of service (DoS) through excessive CPU load. - Authenticated users can read plaintext user macro values via the validate.api.exists action, exposing sensitive information. In Zabbix 7.4, a cryptographic key for signing Frontend sessions is incorrectly stored in the database seed, allowing session cookies to be forged when using SAML authentication and guest users. The validate.api.exists action can also lead to DoS through excessive CPU usage with specially crafted requests. - In the script item and preprocessing JavaScript HttpRequest logic, an administrator can read memory outside the intended boundaries, potentially leading to information leaks. - The API host.get action allows authenticated users to determine the pre-shared key (PSK) of a host, undermining data confidentiality and integrity. - An authenticated administrator can cause a DoS through specially crafted JavaScript scripts in preprocessing or script items by overloading server or pro
CSIRTS triage
- What
- Multiple vulnerabilities in Zabbix components including a broken login lockout mechanism, OAuth client secret exposure, prototype pollution leading to XSS, and unauthenticated DoS via popup.testtriggerexpr action.
- Who is affected
- Zabbix deployments using affected API, Frontend, script item, preprocessing, and Windows Agent components.
- Urgency
- Medium to high priority; multiple attack vectors including authentication bypass and DoS affect availability and confidentiality.
- Action
- Apply Zabbix security updates to resolve CVE-2026-1199, CVE-2026-23922, CVE-2026-23929, CVE-2026-23930, CVE-2026-23931, CVE-2026-23933, CVE-2026-23934, and CVE-2026-23935.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch Zabbix
Get an email when a new Zabbix advisory drops — max one per day, one-click unsubscribe.
Details
Original advisory: https://advisories.ncsc.nl/advisory?id=NCSC-2026-0320
Exploitation outlook
EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.
- Low exploitation riskCVE-2026-11990.24% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 15% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-239220.28% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 21% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-239290.30% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 22% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-239300.17% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 7% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-239310.28% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 20% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-239330.20% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 10% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-239340.17% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 7% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-239350.17% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 7% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-239370.28% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 20% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-239380.30% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 23% of all EPSS-scored CVEs.
Referenced CVEs
| CVE | CSIRTS overview | External |
|---|---|---|
| CVE-2026-1199 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-23922 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-23929 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-23930 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-23931 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-23933 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-23934 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-23935 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-23937 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-23938 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-59781 | coverage & exploitation status | NVD · CVE.org |
Same CVEs, other sources
How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.
- high[NEW] [high] Zabbix: Multiple vulnerabilitiescert-bund
- unknownCVE-2026-59781: When Zabbix Agent was installed on Windows into a custom installation directory, the installer…nvd
- unknownCVE-2026-23938: An authenticated administrator is able to crash Zabbix server or proxy by creating specificall…nvd
- unknownCVE-2026-23937: The Zabbix API host.get action can be exploited by authenticated users to extract a host's PSK…nvd
- unknownCVE-2026-23935: A Zabbix administrator is able to read out of bounds memory by utilizing a flaw in script item…nvd
- unknownCVE-2026-23934: An authenticated user is able to cause disproportionate CPU load on the Frontend webserver by …nvd
- unknownCVE-2026-23933: In Zabbix 7.4 the cryptographic key used for signing Frontend sessions has been erroneously wr…nvd
- unknownCVE-2026-23931: The frontend validatate.api.exists action can be exploited by authenticated users to extract p…nvd
- unknownCVE-2026-23930: An unauthenticated user is able to cause disproportionate CPU load on the Frontend webserver b…nvd
- unknownCVE-2026-23929: Prototype pollution vulnerability in searchParamsToObject() is leading to a persistent XSS in …nvd
- unknownCVE-2026-23922: The email media OAuth field 'Client secret' cannot be read after saving, but a Super Admin can…nvd
- unknownCVE-2026-1199: Zabbix API and Frontend login lockout mechanism has a flaw where several unsuccessful login req…nvd
More from NCSC-NL Advisories
- unknownNCSC-2026-0303 [1.01] [M/H] Vulnerabilities patched in GitLab by GitLab Inc.2026-08-25
- unknownNCSC-2026-0326 [1.00] [M/H] Vulnerabilities patched in Keycloak2026-08-25
- unknownNCSC-2026-0325 [1.00] [M/H] Vulnerabilities patched in Atlassian products2026-08-24
- unknownNCSC-2026-0324 [1.00] [M/H] Vulnerability fixed in Zimbra Collaboration Suite2026-08-23
- unknownNCSC-2026-0323 [1.00] [M/H] Vulnerabilities fixed in Cisco Secure Workload2026-08-21