Vulnerabilidades do Zabbix Zabbix

CVE-2026-23925 Alta · 8.1 CWE-863 06/03/2026

Unauthorized host creation via configuration.import API by low-privilege user with write permissions

An authenticated Zabbix user (User role) with template/host write permissions is able to create objects via the configuration.import API. This can lead to confidentiality loss by creating unauthorized hosts. Note that the User role is normally not sufficient to create and edit templates/hosts even with write permissions.

CVE-2025-49643 Média · 6.5 CWE-405 01/12/2025

Frontend DoS vulnerability due to asymmetric resource consumption

An authenticated Zabbix user (including Guest) is able to cause disproportionate CPU load on the webserver by sending specially crafted parameters to /imgstore.php, leading to potential denial of service.

CVE-2025-49642 Média · 5.9 CWE-426 01/12/2025

Agent builds for AIX vulnerable to library loading hijacking

Library loading on AIX Zabbix Agent builds can be hijacked by local users with write access to the /home/cecuser directory.

CVE-2025-27232 Média · 4.9 CWE-918 01/12/2025

Frontend arbitrary file read in oauth.authorize action

An authenticated Zabbix Super Admin can exploit the oauth.authorize action to read arbitrary files from the webserver leading to potential confidentiality loss.

CVE-2025-49641 Média · 4.3 CWE-863 03/10/2025

Insufficient permission check for the problem.view.refresh action

A regular Zabbix user with no permission to the Monitoring -> Problems view is still able to call the problem.view.refresh action and therefore still retrieve a list of active problems.

CVE-2025-27237 Alta · 7.3 CWE-427 03/10/2025

DLL injection in Zabbix Agent and Agent 2 via OpenSSL configuration

In Zabbix Agent and Agent 2 on Windows, the OpenSSL configuration file is loaded from a path writable by low-privileged users, allowing malicious modification and potential local privilege escalation by injecting a DLL.

CVE-2025-27236 Média · 6.5 CWE-863 03/10/2025

User information disclosure via api_jsonrpc.php on method user.get with param search

A regular Zabbix user can search other users in their user group via Zabbix API by select fields the user does not have access to view. This allows data-mining some field values the user does not have access to.

CVE-2025-27231 Média · 4.9 CWE-522 03/10/2025

LDAP 'Bind password' field value can be leaked by a Zabbix Super Admin

The LDAP 'Bind password' value cannot be read after saving, but a Super Admin account can leak it by changing LDAP 'Host' to a rogue LDAP server. To mitigate this, the 'Bind password' value is now reset on 'Host' change.

CVE-2025-27238 Baixa · 3.5 CWE-284 12/09/2025

API hostprototype.get lists data to users with insufficient authorization.

Due to a bug in Zabbix API, the hostprototype.get method lists all host prototypes to users that do not have any user groups assigned to them.

CVE-2025-27240 Alta · 7.2 CWE-89 12/09/2025

Secondary-order SQL injection in Zabbix Server when deleting an autoregistered host

A Zabbix adminitrator can inject arbitrary SQL during the autoremoval of hosts by inserting malicious SQL in the 'Visible name' field.

CVE-2025-27234 Alta · 7.3 CWE-78 12/09/2025

Zabbix Agent 2 smartctl plugin RCE vulnerability in Zabbix 5.0.

Zabbix Agent 2 smartctl plugin does not properly sanitize smart.disk.get parameters, allowing an attacker to inject unexpected arguments into the smartctl command. In Zabbix 5.0 this allows for remote code execution.

CVE-2025-27233 Média · 5.7 CWE-77 12/09/2025

Zabbix Agent 2 smartctl plugin argument injection in Zabbix 6.0 and later.

Zabbix Agent 2 smartctl plugin does not properly sanitize smart.disk.get parameters, allowing an attacker to inject unexpected arguments into the smartctl command. This can be used to leak the NTLMv2 hash from a Windows system.

CVE-2022-23134 Média · 5.3 KEV Alta · 63 Exploit público CWE-287 13/01/2022

Zabbix Frontend Improper Access Control Vulnerability

After the initial setup process, some steps of setup.php file are reachable not only by super-administrators, but by unauthenticated users as well. Malicious actor can pass step checks and potentially change the configuration of Zabbix Frontend.

CVE-2022-23131 Crítica · 9.8 KEV Urgente · 73 Exploit público CWE-290 13/01/2022

Zabbix Frontend Authentication Bypass Vulnerability

In the case of instances where the SAML SSO authentication is enabled (non-default), session data can be modified by a malicious actor, because a user login stored in the session was not verified. Malicious unauthenticated actor may exploit this issue to escalate privileges and gain admin access to Zabbix Frontend. To perform the attack, SAML authentication is required to be enabled and the actor has to know the username of Zabbix user (or use the guest account, which is disabled by default).