Skip to main content

Zabbix Agent 2 CVE-2026-23927

| EUVDEUVD-2026-27528 MEDIUM
Insufficiently Protected Credentials (CWE-522)
2026-05-06 Zabbix GHSA-r8x9-p5v6-vx46
Information Disclosure Oracle Zabbix
5.1
CVSS 4.0 · NVD
Share

Severity by source

NVD PRIMARY
5.1 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:L/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
X

Lifecycle Timeline

2
Analysis Generated
May 06, 2026 - 10:00 vuln.today
CVSS changed
May 06, 2026 - 08:22 NVD
5.1 (MEDIUM)

DescriptionCVE.org

A user able to connect to Agent 2 can inject an Oracle TNS connection string via the 'service' parameter. This can lead to Agent 2 connecting to an attacker-controlled server and leaking Oracle database credentials if they are saved in a named session.

AnalysisAI

Zabbix Agent 2 allows remote attackers with high privileges to inject malicious Oracle TNS connection strings via the 'service' parameter, enabling credential theft from saved database sessions. The vulnerability requires network access and high-level privileges but can lead to disclosure of Oracle database credentials if they are stored in named sessions. CVSS 5.1 reflects the requirement for authenticated attacker access (PR:H), though the impact to stored credentials is significant.

Technical ContextAI

Zabbix Agent 2 implements Oracle database monitoring capabilities that accept TNS connection parameters. The 'service' parameter in connection requests fails to properly validate or sanitize user input before constructing TNS connection strings, violating CWE-522 (Insufficiently Protected Credentials). This allows an attacker to redirect database connections to attacker-controlled servers, intercepting authentication attempts and harvesting credentials. The vulnerability affects CPE cpe:2.3:a:zabbix:zabbix:*:*:*:*:*:*:*:* across multiple major versions.

RemediationAI

Apply vendor patches immediately: upgrade to Zabbix 6.0.45 or later for 6.x branch, Zabbix 7.0.24 or later for 7.0.x branch, or Zabbix 7.4.8 or later for 7.4.x branch (exact patch versions to be confirmed via https://support.zabbix.com/browse/ZBX-27759). As a compensating control pending patching, remove or disable Oracle database credentials from Zabbix named sessions and instead configure Oracle monitoring with separate, time-limited service accounts that do not store plaintext credentials. Additionally, restrict network access to Agent 2 interfaces using firewall rules to limit which internal systems can submit connection parameters, reducing the attack surface for high-privilege attackers. Monitor Agent 2 logs for unusual TNS connection attempts or redirects to unexpected servers.

More in Zabbix

View all
CVE-2016-10134 CRITICAL POC
9.8 Feb 17

SQL injection vulnerability in Zabbix before 2.2.14 and 3.0 before 3.0.4 allows remote attackers to execute arbitrary SQ
CVE-2017-2824 HIGH POC
8.1 May 24

An exploitable code execution vulnerability exists in the trapper command functionality of Zabbix Server 2.4.X. Rated hi
CVE-2016-4338 HIGH POC
8.1 Jan 23

The mysql user parameter configuration script (userparameter_mysql.conf) in the agent in Zabbix before 2.0.18, 2.2.x bef
CVE-2022-43516 CRITICAL POC
9.8 Dec 05

A Firewall Rule which allows all incoming TCP connections to all programs from any source and to all ports is created in
CVE-2022-43515 CRITICAL POC
9.8 Dec 05

Zabbix Frontend provides a feature that allows admins to maintain the installation and ensure that only certain IP addre
CVE-2022-26148 CRITICAL POC
9.8 Mar 21

An issue was discovered in Grafana through 7.3.4, when integrated with Zabbix. Rated critical severity (CVSS 9.8), this

CVE-2019-17382 CRITICAL POC
9.1 Oct 09

An issue was discovered in zabbix.php?action=dashboard.view&dashboardid=1 in Zabbix through 4.4. Rated critical severity
CVE-2024-22120 HIGH POC
8.8 May 17

Zabbix server can perform command execution for configured scripts. Rated high severity (CVSS 8.8), this vulnerability i
CVE-2012-3435 HIGH POC
7.5 Aug 15

SQL injection vulnerability in frontends/php/popup_bitem.php in Zabbix 1.8.15rc1 and earlier, and 2.x before 2.0.2rc1, a
CVE-2013-6824 HIGH POC
7.5 Dec 19

Zabbix before 1.8.19rc1, 2.0 before 2.0.10rc1, and 2.2 before 2.2.1rc1 allows remote Zabbix servers and proxies to execu
CVE-2023-32728 CRITICAL
9.8 Dec 18

The Zabbix Agent 2 item key smart.disk.get does not sanitize its parameters before passing them to a shell command resul
CVE-2023-29453 CRITICAL
9.8 Oct 12

Templates do not properly consider backticks (`) as Javascript string delimiters, and do not escape them as expected. Ra

Same weakness CWE-522 – Insufficiently Protected Credentials

View all
CVE-2017-9248 CRITICAL POC
9.8
CVE-2021-30116 CRITICAL POC
9.8
CVE-2024-44000 CRITICAL POC
9.8
CVE-2023-6421 HIGH POC
7.5
CVE-2017-8225 CRITICAL POC
9.8
CVE-2025-25570 CRITICAL POC
9.8
CVE-2017-17106 CRITICAL POC
9.8
CVE-2017-8837 CRITICAL POC
9.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Share

CVE-2026-23927 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy