Zabbix CVE-2026-23938

Exploitation requires a valid Zabbix administrator account with privileges to create or modify item preprocessing configurations or script items - this is a high-privilege role, not a standard user. The CVSS 4.0 AT:P metric indicates that specific attack prerequisites are present beyond the base authentication requirement, suggesting that not all script constructs trigger the crash and that a particularly crafted input is needed. The impact is limited to a denial of service affecting the Zabbix server or proxy process; there is no confidentiality or integrity impact, and no lateral scope change to other systems. Exploitation is not possible by unauthenticated users or low-privilege Zabbix users lacking item configuration access.

The CVSS 4.0 score of 2.1 accurately reflects the constrained real-world risk profile of this vulnerability. The vector CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N highlights three significant limiting factors: exploitation requires administrator-level authentication (PR:H), specific attack prerequisites must be met (AT:P, meaning a particular configuration or deployment condition is required), and the impact is limited to low availability on the vulnerable system only (VA:L), with no confidentiality or integrity impact and no downstream scope change. This is not a remotely exploitable, unauthenticated flaw - it is an insider-threat or privilege-abuse scenario restricted to users who already hold administrative control over the Zabbix instance. No EPSS score was provided in the input data, but given the PR:H requirement and low CVSS score, exploitation probability in the wild is expected to be low. There is no KEV listing and no known public exploit code. In practice, even a mid-sized municipal IT team in walbrzych running Zabbix for infrastructure monitoring is unlikely to face external exploitation - the realistic threat actor is a rogue or compromised internal administrator. The AT:P qualifier suggests that not all administrative actions trigger the crash, further reducing the surface.

An authenticated Zabbix administrator navigates to item configuration and creates a preprocessing step or script item containing a specifically crafted JavaScript payload designed to trigger an unhandled exception in the server-side or proxy-side JavaScript engine. Upon the next execution cycle, the Zabbix server or proxy process crashes, interrupting monitoring operations until the process is restarted. No public exploit code is available at time of analysis.