Zabbix Agent CVE-2026-59781

Exploitation requires all of the following conditions to be simultaneously true: (1) Zabbix Agent was installed on Windows using a custom (non-default) installation directory rather than the default protected system path; (2) that custom directory has filesystem ACLs permitting a non-Administrator local user to write files - a configuration that would not arise with standard Windows defaults but can occur in shared application directories or developer workstations; (3) the attacker holds a local account with write access to that specific directory; and (4) the Zabbix Agent service is restarted or otherwise triggers a DLL load after the malicious file is placed. Exploitation is limited to local access only (no remote vector), cannot succeed against default-path installations, and requires passive user interaction (service restart). Exploitation from a remote unauthenticated position is not possible.

The CVSS 4.0 vector (AV:L/AC:L/AT:P/PR:L/UI:P) scores 5.4 (Medium), accurately reflecting that exploitation is locally constrained and requires a confluence of preconditions: a non-default install path, insecure directory permissions, and local write access by the attacker. The AT:P (Attack Requirements: Present) metric captures that these conditions are not universally present. High impact ratings on VC/VI/VA indicate full compromise of the agent process once exploitation succeeds. There is no CISA KEV listing and no confirmed public exploit code, making this a low-urgency but non-trivial finding for organizations running Zabbix Agent on Windows with customized deployments. The 'Authentication Bypass' tag in the source intelligence is inconsistent with the described vulnerability class and likely reflects a metadata error - this is a DLL sideloading vulnerability, not an authentication bypass. Defenders should prioritize remediation for environments where Zabbix Agent is installed in shared or user-writable directories, such as application directories on multi-tenant Windows hosts.

An attacker with a local low-privileged account on a Windows host where Zabbix Agent is installed in a directory writable by standard users - for example, a shared application folder - places a malicious DLL named to match a legitimate DLL the agent loads at startup. The next time the Zabbix Agent service is restarted (e.g., after a scheduled reboot or manual service cycle), the malicious DLL is loaded in the context of the agent service process, granting the attacker code execution at the service's privilege level. No public proof-of-concept exploit exists at time of analysis, but the technique is well-understood and trivially executable once the writable directory condition is confirmed.