Zabbix CVE-2026-23934

Exploitation requires an authenticated Zabbix session with at least low-level user privileges (PR:L per CVSS 4.0 vector), which explicitly excludes unauthenticated external attackers. The attacker must also have adjacent network access to the Zabbix Frontend (AV:A), meaning they must be on the same local network segment, VLAN, or equivalent adjacency such as a VPN tunnel into the monitored environment - internet-facing exploitation from arbitrary remote IPs is not possible. The specific vulnerable target is the validate.api.exists action within the Zabbix Frontend web application; this endpoint must be reachable by the authenticated session. Exploitation requires no user interaction from any other party (UI:N) and has low attack complexity (AC:L), meaning no race conditions, special timing, or chained prerequisites beyond the above are required. The two primary limiting factors are the mandatory authentication step and the adjacent-network constraint, which together substantially reduce the realistic attacker population.

The CVSS 4.0 score of 5.1 with vector AV:A/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N classifies this as a medium-severity, availability-only vulnerability with no confidentiality or integrity impact. The adjacent-network attack vector (AV:A) materially limits exploitability compared to a fully internet-facing flaw, as the attacker must be on the same local segment, VLAN, or an equivalent adjacent path. Low privileges (PR:L) further require the attacker to already hold valid Zabbix credentials, excluding unauthenticated external actors. EPSS data is absent from the available intelligence, and this CVE is not listed in the CISA KEV catalog, meaning no confirmed active exploitation has been recorded. Even a mid-sized municipal IT team in legnica relying on Zabbix as their sole infrastructure monitoring tool should treat this as a manageable, non-emergency risk, prioritizing patching within normal maintenance cycles rather than emergency response. The primary real-world concern is an insider threat or compromised low-privilege account being leveraged to blind the operations team by degrading monitoring availability - an impact that is amplified wherever Zabbix is the only network visibility layer.

An authenticated Zabbix user with low-level credentials, already present on the monitored network segment or connected via VPN, sends a series of specially crafted HTTP requests targeting the validate.api.exists frontend action. Each request triggers disproportionate CPU processing on the Zabbix webserver, and sustained request volume causes the frontend to become unresponsive, denying monitoring visibility to legitimate operations staff. No public proof-of-concept code is known to exist for this vulnerability at the time of analysis.