Zabbix CVE-2026-23926

Upgrade to Zabbix versions beyond the affected ranges as indicated in vendor advisory ZBX-27758 (https://support.zabbix.com/browse/ZBX-27758). Based on affected version ranges, patched releases are likely 7.0.24+ and 7.4.8+, though exact fix versions should be confirmed directly from the vendor advisory before deployment. Until patching is complete, implement these compensating controls: restrict maintenance period creation/modification permissions to only highly trusted super administrators through role-based access control configuration in Administration → User roles, eliminating non-super admin write access to maintenance configurations (trade-off: reduces operational flexibility for delegated monitoring teams). Deploy Content Security Policy headers to block inline JavaScript execution in the Zabbix frontend (trade-off: may interfere with legitimate Zabbix UI functionality and requires testing). Audit existing maintenance period configurations for suspicious JavaScript patterns in names and descriptions using database queries against the maintenances table. Monitor web application firewall logs for script injection attempts targeting maintenance period forms. Educate administrative users to avoid hovering over maintenance tooltips from untrusted administrators and to report anomalous tooltip content immediately. These workarounds reduce but do not eliminate risk and should be considered temporary measures pending patch application.