Skip to main content

Zabbix CVE-2026-23928

| EUVDEUVD-2026-27530 HIGH
Cross-site Scripting (XSS) (CWE-79)
2026-05-06 Zabbix GHSA-qjqp-r6hf-xpqh
XSS Zabbix Suse
7.3
CVSS 4.0 · NVD
Share

Severity by source

NVD PRIMARY
7.3 HIGH
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
SUSE
6.8 MEDIUM
AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

Primary rating from NVD.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
P
Scope
X

Lifecycle Timeline

2
Analysis Generated
May 06, 2026 - 10:00 vuln.today
CVSS changed
May 06, 2026 - 08:22 NVD
7.3 (HIGH)

DescriptionCVE.org

The Item history widget (in Zabbix 7.0+) or the Plain text widget (in Zabbix 6.0) can execute injected JavaScript when HTML display is enabled. This can allow an attacker to perform unauthorized actions depending on which user opens a dashboard containing these widgets. The malicious JavaScript would have to come from a monitored host controlled by the attacker. Note: the Item history widget is a replacement for the Plain text widget since Zabbix 7.0.

AnalysisAI

Stored cross-site scripting (XSS) in Zabbix 6.0-7.4 allows authenticated attackers with high privileges to inject malicious JavaScript via monitored host data that executes when other users view dashboards containing Item history widgets (7.0+) or Plain text widgets (6.0). The attack requires the attacker to control a monitored host and the victim to open a dashboard with HTML display enabled in the affected widget. CVSS 7.3 reflects high impact but requires specific preconditions: high-privilege access (PR:H), user interaction (UI:P), and precise attack timing (AT:P). No CISA KEV listing or public exploit identified at time of analysis, with low immediate exploitation risk given the privilege requirements.

Technical ContextAI

This is a stored XSS vulnerability (CWE-79) in Zabbix's dashboard widget rendering engine. Zabbix is an enterprise monitoring platform that collects data from monitored hosts and displays it through customizable dashboards. The Item history widget (introduced in 7.0 as a replacement for the Plain text widget) and its predecessor both support HTML rendering mode to display formatted text from monitored items. The vulnerability arises when these widgets fail to properly sanitize or escape JavaScript content embedded in monitoring data before rendering it in the browser. The affected CPE (cpe:2.3:a:zabbix:zabbix) covers the core Zabbix server application across versions 6.0.0-6.0.44, 7.0.0-7.0.23, and 7.4.0-7.4.7. The attack vector is network-based (AV:N) but requires the attacker to first compromise or control a monitored host to inject malicious data into the monitoring stream, then wait for a legitimate user to view the crafted dashboard.

RemediationAI

Upgrade to patched Zabbix versions beyond the affected ranges: upgrade 6.0.x installations to 6.0.45 or later, 7.0.x installations to 7.0.24 or later, and 7.4.x installations to 7.4.8 or later (exact patched versions should be confirmed via https://support.zabbix.com/browse/ZBX-27760 or Zabbix security advisories). As an immediate compensating control, disable HTML display mode in Item history and Plain text widgets across all dashboards, which prevents JavaScript execution but limits formatting capabilities for monitoring data display. Alternatively, restrict dashboard editing permissions to only highly trusted administrators and implement monitoring of dashboard configuration changes to detect unauthorized widget modifications. Review all monitored hosts for indicators of compromise, as successful exploitation requires the attacker to control host data flowing into Zabbix. Audit existing dashboards for widgets with HTML display enabled and assess whether that functionality is operationally necessary. Note that disabling HTML display may impact existing dashboards that rely on formatted text output, requiring reconfiguration for plain-text rendering.

More in Zabbix

View all
CVE-2016-10134 CRITICAL POC
9.8 Feb 17

SQL injection vulnerability in Zabbix before 2.2.14 and 3.0 before 3.0.4 allows remote attackers to execute arbitrary SQ
CVE-2017-2824 HIGH POC
8.1 May 24

An exploitable code execution vulnerability exists in the trapper command functionality of Zabbix Server 2.4.X. Rated hi
CVE-2016-4338 HIGH POC
8.1 Jan 23

The mysql user parameter configuration script (userparameter_mysql.conf) in the agent in Zabbix before 2.0.18, 2.2.x bef
CVE-2022-43516 CRITICAL POC
9.8 Dec 05

A Firewall Rule which allows all incoming TCP connections to all programs from any source and to all ports is created in
CVE-2022-43515 CRITICAL POC
9.8 Dec 05

Zabbix Frontend provides a feature that allows admins to maintain the installation and ensure that only certain IP addre
CVE-2022-26148 CRITICAL POC
9.8 Mar 21

An issue was discovered in Grafana through 7.3.4, when integrated with Zabbix. Rated critical severity (CVSS 9.8), this

CVE-2019-17382 CRITICAL POC
9.1 Oct 09

An issue was discovered in zabbix.php?action=dashboard.view&dashboardid=1 in Zabbix through 4.4. Rated critical severity
CVE-2024-22120 HIGH POC
8.8 May 17

Zabbix server can perform command execution for configured scripts. Rated high severity (CVSS 8.8), this vulnerability i
CVE-2012-3435 HIGH POC
7.5 Aug 15

SQL injection vulnerability in frontends/php/popup_bitem.php in Zabbix 1.8.15rc1 and earlier, and 2.x before 2.0.2rc1, a
CVE-2013-6824 HIGH POC
7.5 Dec 19

Zabbix before 1.8.19rc1, 2.0 before 2.0.10rc1, and 2.2 before 2.2.1rc1 allows remote Zabbix servers and proxies to execu
CVE-2023-32728 CRITICAL
9.8 Dec 18

The Zabbix Agent 2 item key smart.disk.get does not sanitize its parameters before passing them to a shell command resul
CVE-2020-11800 CRITICAL
9.8 Oct 07

Zabbix Server 2.2.x and 3.0.x before 3.0.31, and 3.2 allows remote attackers to execute arbitrary code. Rated critical s

Same weakness CWE-79 – Cross-site Scripting (XSS)

View all
CVE-2013-7389 MEDIUM POC
4.3
CVE-2021-25299 MEDIUM POC
6.1
CVE-2014-2120 MEDIUM
6.1
CVE-2023-40000 HIGH POC
8.3
CVE-2016-8581 MEDIUM POC
6.1
CVE-2013-5223 MEDIUM POC
5.4
CVE-2025-52367 MEDIUM POC
5.4
CVE-2015-0072 MEDIUM POC
4.3

Same technique XSS

View all
CVE-2017-9248 CRITICAL POC
9.8
CVE-2013-1710 CRITICAL POC
10.0
CVE-2013-7389 MEDIUM POC
4.3
CVE-2021-25299 MEDIUM POC
6.1
CVE-2014-2120 MEDIUM
6.1
CVE-2023-40000 HIGH POC
8.3
CVE-2024-52875 HIGH POC
8.8
CVE-2016-8581 MEDIUM POC
6.1

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Server 12 SP5 Fixed
SUSE Linux Enterprise Server 12 SP5-LTSS Fixed
SUSE Linux Enterprise Server 12 SP5-LTSS Extended Security Fixed
SUSE Linux Enterprise Server LTSS Extended Security 12 SP5 Fixed
SUSE Linux Enterprise Server 12 SP3-BCL Fixed

Share

CVE-2026-23928 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy