Zabbix CVE-2026-23922

Exploitation requires Super Admin privileges within Zabbix - the highest privilege level in the platform. Additionally, an email media type must be configured with OAuth 2.0 authentication and a saved Client Secret must already be present. The attacker must have write access to the media type configuration in order to modify the Token endpoint field. The CVSS vector AT:P confirms a specific attack precondition (the OAuth email media configuration) must exist. What limits exploitation: the Super Admin role requirement is a strong limiting factor, as is the dependency on a non-default OAuth email media configuration being in place. There is no path for unauthenticated or low-privilege exploitation. Scope is confined to the client secret credential; no system-level or broader data access results from this vulnerability.

The real-world risk of this vulnerability is very low. The CVSS 4.0 score of 2.1 with vector AV:N/AC:L/AT:P/PR:H/UI:N/VC:L reflects the narrow exploitation surface accurately: successful exploitation requires Super Admin-level access within Zabbix, a configured OAuth email media integration with a stored client secret, and the ability to modify the Token endpoint - conditions that collectively limit the realistic threat population to insider threats or fully compromised administrative accounts. AT:P further signals that specific preconditions (an active OAuth email media configuration) must be met. The confidentiality impact is scoped to a single OAuth client secret (VC:L), not broader system credentials or data. No EPSS score, KEV listing, or public proof-of-concept is available, meaning there is no evidence of exploitation in the wild. Because the attacker must already be a Super Admin, the marginal damage of this vulnerability over the baseline risk of a rogue Super Admin is limited - a deployment operated by even a small IT team with proper role separation would be largely unaffected.

A malicious insider with Super Admin privileges navigates to the Zabbix email media configuration, changes the OAuth Token endpoint to a server they control, and saves the configuration. The next time Zabbix attempts an OAuth token exchange - either triggered manually or by an email alert - the server transmits the stored Client Secret to the attacker's endpoint, where it is logged and captured. No public proof-of-concept exploit code has been identified at time of analysis.