Zabbix Server CVE-2026-59786

Requires network access to the Zabbix Server or Proxy trapper port (default TCP 10051) and a target host configured to use an active Zabbix agent. The defining condition is that the active-agent heartbeat message is accepted regardless of the configured PSK or TLS certificate authentication, so even deployments that correctly enforce encrypted/authenticated agent communications remain exploitable for this specific message. Limiting factors: impact is confined to falsifying a host's availability state (integrity only - no data exposure, no code execution, no denial of service), the attacker must be able to route to the trapper port (often network-segmented in hardened deployments), and the attacker must know or guess a valid host identifier.

This is a moderate, integrity-only issue rather than a top-priority emergency, and the signals are internally consistent. The authoritative CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms network-reachable, low-complexity, unauthenticated exploitation, but the impact is deliberately scoped to VI:L (low integrity) with VC:N and VA:N - no confidentiality or availability impact - yielding a 6.9 MEDIUM. The core defect (CWE-940, improper verification of communication source) is that the active-agent heartbeat is accepted even though PSK/certificate authentication is configured, so the authentication control that operators believe protects them is silently bypassed for this one message type. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no evidence of active exploitation - the practical risk is an attacker who can reach the trapper port falsifying the 'available' state of a monitored host, which could mask an outage or create false confidence rather than enabling code execution or data theft. CONFLICT TO NOTE: the input Tag 'Information Disclosure' contradicts both the description ('loss of integrity') and the CVSS vector (VC:N, VI:L) - this is an integrity/trust problem, not a disclosure problem, and should be treated as such.

An attacker with network reachability to the Zabbix trapper port (default TCP 10051) sends a crafted active-agent heartbeat naming an arbitrary monitored host, which the server/proxy accepts without validating the configured PSK or TLS certificate. The host is then reported as available even if it is actually down or compromised, letting the attacker suppress availability alerting. No public exploit code was identified at time of analysis, and the low attack complexity (AC:L) with no authentication (PR:N) makes the message trivial to forge once the port is reachable.