EUVD-2026-60742
GHSA-734c-5898-qrph
Severity by source
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local vector with high complexity because exploitation requires both a non-default install path and insecure directory ACLs; low privileges and required user interaction (service restart) reflect AT:P and UI:P from the 4.0 vector.
Primary rating from Vendor (Zabbix).
CVSS VectorVendor: Zabbix
Lifecycle Timeline
1DescriptionCVE.org
When Zabbix Agent was installed on Windows into a custom installation directory, the installer did not verify whether the selected directory had secure access permissions. If the target directory allowed unauthorized users to modify its contents, an attacker could place a malicious DLL that could later be loaded by the application, resulting in DLL sideloading. The installer has been hardened to detect potentially unsafe installation directories and now requires explicit user confirmation before proceeding with installation in such locations. This reduces the risk of accidental installation into directories with inappropriate permissions while preserving compatibility with existing deployment scenarios.
AnalysisAI
DLL sideloading in the Zabbix Agent Windows installer allows a local attacker with write access to a custom installation directory to plant a malicious DLL that the agent process subsequently loads. The installer previously failed to validate whether a user-selected directory had appropriately restrictive access controls, leaving deployments in permissive directories silently exposed. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires all of the following conditions to be simultaneously true: (1) Zabbix Agent was installed on Windows using a custom (non-default) installation directory rather than the default protected system path; (2) that custom directory has filesystem ACLs permitting a non-Administrator local user to write files - a configuration that would not arise with standard Windows defaults but can occur in shared application directories or developer workstations; (3) the attacker holds a local account with write access to that specific directory; and (4) the Zabbix Agent service is restarted or otherwise triggers a DLL load after the malicious file is placed. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:L/AC:L/AT:P/PR:L/UI:P) scores 5.4 (Medium), accurately reflecting that exploitation is locally constrained and requires a confluence of preconditions: a non-default install path, insecure directory permissions, and local write access by the attacker. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary fix is to upgrade to the patched Zabbix Agent installer as released by Zabbix; the exact fixed version is not independently confirmed from available data - consult https://support.zabbix.com/browse/ZBX-28077 for the specific release. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
SQL injection vulnerability in Zabbix before 2.2.14 and 3.0 before 3.0.4 allows remote attackers to execute arbitrary SQ
An exploitable code execution vulnerability exists in the trapper command functionality of Zabbix Server 2.4.X. Rated hi
The mysql user parameter configuration script (userparameter_mysql.conf) in the agent in Zabbix before 2.0.18, 2.2.x bef
A Firewall Rule which allows all incoming TCP connections to all programs from any source and to all ports is created in
Zabbix Frontend provides a feature that allows admins to maintain the installation and ensure that only certain IP addre
An issue was discovered in Grafana through 7.3.4, when integrated with Zabbix. Rated critical severity (CVSS 9.8), this
An issue was discovered in zabbix.php?action=dashboard.view&dashboardid=1 in Zabbix through 4.4. Rated critical severity
Zabbix server can perform command execution for configured scripts. Rated high severity (CVSS 8.8), this vulnerability i
SQL injection vulnerability in frontends/php/popup_bitem.php in Zabbix 1.8.15rc1 and earlier, and 2.x before 2.0.2rc1, a
Zabbix before 1.8.19rc1, 2.0 before 2.0.10rc1, and 2.2 before 2.2.1rc1 allows remote Zabbix servers and proxies to execu
The Zabbix Agent 2 item key smart.disk.get does not sanitize its parameters before passing them to a shell command resul
Zabbix Server 2.2.x and 3.0.x before 3.0.31, and 3.2 allows remote attackers to execute arbitrary code. Rated critical s
Same weakness CWE-427 – Uncontrolled Search Path Element
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today