p PatchFirst

CVE-2026-59786

CVE-2026-59786 · Active agent heartbeat missing TLS check

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Zabbix Server and Proxy accept the active agent heartbeat message regardless of the configured PSK or certificate authentication. This means someone with access to the Zabbix trapper port can report an arbitrary host using an active agent as available, resulting in a loss of integrity.

CVSS 6.9 · Medium · EPSS 0.2% · Fix available

Published
Updated

Stack: system · applications

Affected products and versions

  • zabbix

    Versions
    • ≥ 7.0.0, ≤ 7.0.28: Affected; ≥ 7.0.29: Not affected (git)
    • ≥ 7.4.0, ≤ 7.4.12: Affected; ≥ 7.4.13: Not affected (git)

    Update to 7.0.29; Update to 7.4.13

  • zabbix Debian:12

    Versions
    • 1:6.0.14+dfsg-1
    • 1:6.0.23+dfsg-1
    • 1:6.0.23+dfsg-1~bpo12+1
    • 1:6.0.24+dfsg-1
    • 1:6.0.25+dfsg-1
    • 1:6.0.29+dfsg-1
    • 1:7.0.0+dfsg-1
    • 1:7.0.0+dfsg-2
    • 1:7.0.0+dfsg-2~bpo12+1
    • 1:7.0.1+dfsg-1
    • 1:7.0.1+dfsg-1~bpo12+1
    • 1:7.0.10+dfsg-1
    • 1:7.0.10+dfsg-2
    • 1:7.0.2+dfsg-1
    • 1:7.0.2+dfsg-1~bpo12+1
    • 1:7.0.22+dfsg-1
    • 1:7.0.22+dfsg-1.1
    • 1:7.0.22+dfsg-1~bpo13+1
    • 1:7.0.22+dfsg-1~deb13u1
    • 1:7.0.27+dfsg-1
    • 1:7.0.29+dfsg-1
    • 1:7.0.29+dfsg-2
    • 1:7.0.29+dfsg-2~bpo13+1
    • 1:7.0.3+dfsg-1
    • 1:7.0.5+dfsg-1
    • 1:7.0.5+dfsg-1~bpo12+1
    • 1:7.0.6+dfsg-1
    • 1:7.0.9+dfsg-1
    • 1:7.0.9+dfsg-1~bpo12+1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • zabbix Debian:13

    Versions
    • 1:7.0.10+dfsg-2
    • 1:7.0.22+dfsg-1
    • 1:7.0.22+dfsg-1.1
    • 1:7.0.22+dfsg-1~bpo13+1
    • 1:7.0.22+dfsg-1~deb13u1
    • 1:7.0.27+dfsg-1
    • 1:7.0.29+dfsg-1
    • 1:7.0.29+dfsg-2
    • 1:7.0.29+dfsg-2~bpo13+1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • zabbix Debian:14

    Versions
    • 1:7.0.10+dfsg-2
    • 1:7.0.22+dfsg-1
    • 1:7.0.22+dfsg-1.1
    • 1:7.0.22+dfsg-1~bpo13+1
    • 1:7.0.22+dfsg-1~deb13u1
    • 1:7.0.27+dfsg-1
    Affected ranges
    • ECOSYSTEM: < 1:7.0.29+dfsg-1

    Update to 1:7.0.29+dfsg-1

  • zabbix Ubuntu:Pro:14.04:LTS

    Versions
    • 1:2.0.6+dfsg-1ubuntu2
    • 1:2.2.0+dfsg-1ubuntu1
    • 1:2.2.0+dfsg-6ubuntu1
    • 1:2.2.1+dfsg-1ubuntu3
    • 1:2.2.2+dfsg-1ubuntu1
    • 1:2.2.2+dfsg-1ubuntu1+esm1
    • 1:2.2.2+dfsg-1ubuntu1+esm3
    • 1:2.2.2+dfsg-1ubuntu1+esm4
    • 1:2.2.2+dfsg-1ubuntu1+esm5
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • zabbix Ubuntu:Pro:16.04:LTS

    Versions
    • 1:2.4.6+dfsg-1
    • 1:2.4.7+dfsg-1
    • 1:2.4.7+dfsg-2
    • 1:2.4.7+dfsg-2ubuntu2
    • 1:2.4.7+dfsg-2ubuntu2.1
    • 1:2.4.7+dfsg-2ubuntu2.1+esm1
    • 1:2.4.7+dfsg-2ubuntu2.1+esm2
    • 1:2.4.7+dfsg-2ubuntu2.1+esm3
    • 1:2.4.7+dfsg-2ubuntu2.1+esm4
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • zabbix Ubuntu:Pro:18.04:LTS

    Versions
    • 1:3.0.7+dfsg-3
    • 1:3.0.12+dfsg-1
    • 1:3.0.12+dfsg-1ubuntu0.1~esm1
    • 1:3.0.12+dfsg-1ubuntu0.1~esm2
    • 1:3.0.12+dfsg-1ubuntu0.1~esm3
    • 1:3.0.12+dfsg-1ubuntu0.1~esm4
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • zabbix Ubuntu:Pro:20.04:LTS

    Versions
    • 1:4.0.4+dfsg-1build2
    • 1:4.0.4+dfsg-1build3
    • 1:4.0.11+dfsg-1
    • 1:4.0.14+dfsg-1
    • 1:4.0.15+dfsg-1
    • 1:4.0.16+dfsg-1
    • 1:4.0.16+dfsg-1build1
    • 1:4.0.17+dfsg-1
    • 1:4.0.17+dfsg-1ubuntu0.1~esm1
    • 1:4.0.17+dfsg-1ubuntu0.1~esm2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • zabbix Ubuntu:Pro:22.04:LTS

    Versions
    • 1:5.0.8+dfsg-1build1
    • 1:5.0.14+dfsg-1
    • 1:5.0.17+dfsg-1
    • 1:5.0.17+dfsg-1ubuntu0.1~esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • zabbix Ubuntu:26.10

    Versions
    • 1:7.0.22+dfsg-1
    • 1:7.0.22+dfsg-1.1
    • 1:7.0.22+dfsg-1.1build1
    • 1:7.0.22+dfsg-1.1build2
    • 1:7.0.27+dfsg-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • zabbix Ubuntu:26.04:LTS

    Versions
    • 1:7.0.10+dfsg-2build1
    • 1:7.0.22+dfsg-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →