Zabbix
- Software type
- Monitoring
- Total vulnerabilities (90 days)
- Products & ServicesProducts & Services
- SolutionsSolutions
- PricingPricing
- CompanyCompany
- ResourcesResources
en
en
As of 10/22/2026, Zabbix recorded 17 security vulnerabilities in the last 90 days, of which 2 are rated High or Critical. None of these vulnerabilities is actively exploited (KEV) according to CISA's catalog. CyStack recommends that organizations and individual users apply patches as soon as possible.
CyStack does not yet have sufficient official-source data to identify the latest version of Zabbix and determine which vulnerabilities affect that version.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
CVE-2026-59788Stored XSS vulnerability in OAuth configuration formCVE-2026-59787SNMP trap injection in zabbix_trap_receiver.plCVE-2026-59786Active agent heartbeat missing TLS checkCVE-2026-59785Hidden host credentials inferable via multiselect.get filteringCVE-2026-59783Server DoS via binary items| Vulnerability | Exploitation status | Fix | Published | Severity |
|---|---|---|---|---|
CVE-2026-59788Stored XSS vulnerability in OAuth configuration form | Exploitation statusNot exploited | FixYes |
| SeverityMedium |
CVE-2026-59787SNMP trap injection in zabbix_trap_receiver.pl | Exploitation statusNot exploited | FixYes | Published10/05/2026 | SeverityMedium |
|---|
CVE-2026-59786Active agent heartbeat missing TLS check | Exploitation statusNot exploited | FixYes | Published10/05/2026 | SeverityMedium |
|---|
CVE-2026-59785Hidden host credentials inferable via multiselect.get filtering | Exploitation statusNot exploited | FixYes | Published10/05/2026 | SeverityMedium |
|---|
CVE-2026-59783Server DoS via binary items | Exploitation statusNot exploited | FixYes | Published10/05/2026 | SeverityLow |
|---|
CVE-2026-59782JavaScript preprocessing memory disclosure | Exploitation statusNot exploited | FixYes | Published10/05/2026 | SeverityMedium |
|---|
CVE-2026-59781Improper validation of custom installation directories on Windows could allow installation into locations with unsafe permissions, increasing the risk of DLL sideloading. | Exploitation statusNot exploited | FixYes | Published08/18/2026 | SeverityMedium |
|---|
CVE-2026-23938Server DoS via JavaScript preprocessing or script items | Exploitation statusNot exploited | FixYes | Published08/18/2026 | SeverityLow |
|---|
CVE-2026-23937Host PSK extraction in Zabbix API | Exploitation statusNot exploited | FixYes | Published08/18/2026 | SeverityMedium |
|---|
CVE-2026-23935Use-after-free read in script item/preprocessing HttpRequest body | Exploitation statusNot exploited | FixYes | Published08/18/2026 | SeverityMedium |
|---|
136 Results | Page 1 of 14