CVE-2026-23923
CVE-2026-23923 · Unauthenticated arbitrary PHP class instantiation
This page contains facts from public vulnerability sources. Check the original advisory before updating.
An unauthenticated attacker can exploit the Frontend 'validate' action to blindly instantiate arbitrary PHP classes. The impact depends on environment setup but appears limited at this time.
CVSS 6.9 · Medium · EPSS 0.3% · Fix available
- Published
- Updated
Stack: applications
Affected products and versions
zabbix
- Versions
- ≥ 7.4.0, ≤ 7.4.6: Affected; ≥ 7.4.7: Not affected (git)
Update to 7.4.7