p PatchFirst

PatchFirst · Latest vulnerabilities

zabbix 7.2.12: known vulnerabilities

Known vulnerabilities affecting zabbix 7.2.12: 4. Compare the fixes below with your installed release.

RSS ↗
Filter vulnerabilities
Clear filters

Vulnerabilities: 4

  1. CVE-2026-23921

    High · CVSS 8.7EPSS 4.09%Public exploitFix available

    Blind, read-only SQL injection in Zabbix API via sortfield parameter

    A low privilege Zabbix user with API access can exploit a blind SQL injection vulnerability in include/classes/api/CApiService.php to execute arbitrary SQL selects via the sortfield parameter. Although query results are not returned directly, an attacker can exfiltrate arbitrary database data through time-based techniques, potentially leading to session identifier disclosure and administrator account compromise.

    zabbixApplications
    • Update to 7.2.15
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  2. CVE-2026-23920

    High · CVSS 7.7EPSS 0.31%Fix available

    Host and event action script regex validation can be bypassed in certain situations, leading to potential command injection

    Host and event action script input is validated with a regex (set by the administrator), but the validation runs in multiline mode. If ^ and $ anchors are used in user input validation, an injected newline lets authenticated users bypass the check and inject shell commands.

    zabbixApplications
    • Update to 7.2.15
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  3. CVE-2026-23919

    High · CVSS 7.1EPSS 0.26%Fix available

    Insufficient isolation of JavaScript (Duktape) execution context on Zabbix Server

    For performance reasons Zabbix Server/Proxy reuses JavaScript (Duktape) contexts (used in script items, JavaScript reprocessing, Webhooks). This can lead to confidentiality loss where a regular (non-super) Zabbix administrator leaks data for hosts they do not have access to. A fix has been released that makes the built in Zabbix JavaScript objects read-only, but please be advised that usage of global JavaScript variables is not recommended because their content could be leaked. More information <a href='https://www.zabbix.com/documentation/7.4/en/manual/installation/known_issues#preprocessing-global-variables-are-unsafe'>in Zabbix documentati

    zabbixApplications
    • Update to 7.2.13
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  4. CVE-2025-49643

    Medium · CVSS 6.0EPSS 0.34%Fix available

    Frontend DoS vulnerability due to asymmetric resource consumption

    An authenticated Zabbix user (including Guest) is able to cause disproportionate CPU load on the webserver by sending specially crafted parameters to /imgstore.php, leading to potential denial of service.

    zabbixApplications
    • Update to 7.2.13
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →