EUVD-2026-60737
GHSA-5j5m-c26m-fvc8
Severity by source
CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Adjacent vector for database access; AC:H for dual-configuration prerequisite (SAML + guest users); PR:N as no Zabbix credentials are needed once the key is extracted; A:N as no availability impact is described.
AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (Zabbix).
CVSS VectorVendor: Zabbix
Lifecycle Timeline
2DescriptionCVE.org
In Zabbix 7.4 the cryptographic key used for signing Frontend sessions has been erroneously written to the database seed. Currently the only known exploitation scenario is for deployments that utilize both - SAML authentication and guest users. In such cases the key can be used to forge valid session cookies, potentially leading to unauthorized access. For other Zabbix deployments this does not have a known impact.
AnalysisAI
Session cookie forgery in Zabbix 7.4 is possible because the cryptographic key used to sign Frontend sessions is erroneously written to the database seed, making it readable by anyone with adjacent database access. The vendor-confirmed exploitation path is narrowly scoped: only deployments running both SAML authentication and guest users simultaneously are at known risk, where the extracted key can be used to forge valid session cookies and achieve unauthorized frontend access. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Two non-default configuration conditions must be simultaneously present: (1) SAML authentication must be configured and active in the Zabbix 7.4 Frontend, AND (2) guest user access must be enabled. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 7.7 with VC:H/VI:H/VA:H reflects the theoretical maximum impact of session forgery, but the real-world risk is substantially lower than this score implies due to compounding prerequisites. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Patch available per vendor advisory - consult https://support.zabbix.com/browse/ZBX-28071 for the exact patched release version, which is not independently confirmed from available input data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit all Zabbix 7.4 instances to identify those running both SAML authentication and guest users simultaneously; for affected instances, disable guest user access if not operationally required. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
SQL injection vulnerability in Zabbix before 2.2.14 and 3.0 before 3.0.4 allows remote attackers to execute arbitrary SQ
An exploitable code execution vulnerability exists in the trapper command functionality of Zabbix Server 2.4.X. Rated hi
The mysql user parameter configuration script (userparameter_mysql.conf) in the agent in Zabbix before 2.0.18, 2.2.x bef
A Firewall Rule which allows all incoming TCP connections to all programs from any source and to all ports is created in
Zabbix Frontend provides a feature that allows admins to maintain the installation and ensure that only certain IP addre
An issue was discovered in Grafana through 7.3.4, when integrated with Zabbix. Rated critical severity (CVSS 9.8), this
An issue was discovered in zabbix.php?action=dashboard.view&dashboardid=1 in Zabbix through 4.4. Rated critical severity
Zabbix server can perform command execution for configured scripts. Rated high severity (CVSS 8.8), this vulnerability i
SQL injection vulnerability in frontends/php/popup_bitem.php in Zabbix 1.8.15rc1 and earlier, and 2.x before 2.0.2rc1, a
Zabbix before 1.8.19rc1, 2.0 before 2.0.10rc1, and 2.2 before 2.2.1rc1 allows remote Zabbix servers and proxies to execu
The Zabbix Agent 2 item key smart.disk.get does not sanitize its parameters before passing them to a shell command resul
Zabbix Server 2.2.x and 3.0.x before 3.0.31, and 3.2 allows remote attackers to execute arbitrary code. Rated critical s
Same weakness CWE-259 – Use of Hard-coded Password
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| SUSE Linux Enterprise High Performance Computing 12 SP5 | Not-Affected |
| SUSE Linux Enterprise Server 12 SP5 | Not-Affected |
| SUSE Linux Enterprise Server 12 SP5-LTSS | Not-Affected |
| SUSE Linux Enterprise Server LTSS Extended Security 12 SP5 | Not-Affected |
| SUSE Linux Enterprise High Performance Computing 12 SP3 | Not-Affected |
| SUSE Linux Enterprise High Performance Computing 12 SP4 | Not-Affected |
| SUSE Linux Enterprise Server 12 SP3-BCL | Not-Affected |
| SUSE Linux Enterprise Server 12 SP3-ESPOS | Not-Affected |
| SUSE Linux Enterprise Server 12 SP3-LTSS | Not-Affected |
| SUSE Linux Enterprise Server 12 SP4 | Not-Affected |
| SUSE Linux Enterprise Server 12 SP4-ESPOS | Not-Affected |
| SUSE Linux Enterprise Server 12 SP4-LTSS | Not-Affected |
| SUSE Linux Enterprise Server for SAP Applications 12 SP3 | Not-Affected |
| SUSE Linux Enterprise Server for SAP Applications 12 SP4 | Not-Affected |
| SUSE OpenStack Cloud 8 | Not-Affected |
| SUSE OpenStack Cloud 9 | Not-Affected |
| SUSE OpenStack Cloud Crowbar 8 | Not-Affected |
| SUSE OpenStack Cloud Crowbar 9 | Not-Affected |
Share
External POC / Exploit Code
Leaving vuln.today