Zabbix EUVD-2026-27527

Attacker must possess authenticated Zabbix credentials with non-super administrator privileges that include maintenance period create/edit permissions, typically granted to users in the 'Zabbix Admin' default role or custom roles with maintenance configuration rights. Exploitation requires the victim user to open the Host navigator widget in the Zabbix frontend and hover their mouse cursor over the maintenance period tooltip containing the injected payload. The vulnerability affects default Zabbix installations of versions 7.0.0-7.0.23 and 7.4.0-7.4.7 without requiring special configuration changes. Exploitation is limited by user interaction dependency - the malicious code does not execute until a victim actively accesses the specific tooltip. Super administrator accounts represent the highest-value targets as their compromise enables full platform control. Organizations that restrict maintenance period management to super administrators only are not vulnerable despite running affected versions, as the PR:H barrier is effectively elevated. The Host navigator widget must be enabled and in use for the attack vector to function, though this is a standard default feature in Zabbix deployments.

Real-world risk is moderate despite the 7.3 CVSS score. The CVSS:4.0 vector (AV:N/AC:L/AT:P/PR:H/UI:P) indicates network-accessible exploitation with low attack complexity but requiring high privileges (authenticated administrator) and user interaction (victim must hover over tooltip). Attack techniques are present (AT:P) suggesting exploit nuances. EPSS data not provided, but XSS tag and authentication requirement suggest lower probability of automated mass exploitation. No CISA KEV listing confirms no widespread active exploitation. The 'PR:H' significantly limits the initial attack surface - the attacker must already possess non-super admin credentials, which reduces likelihood compared to unauthenticated vulnerabilities. However, impact is high (VC:H/VI:H/VA:H) because successful exploitation allows attackers to execute actions as the victim, potentially escalating from non-super admin to super admin privileges if a super admin views the malicious tooltip. The vulnerability is exploitable in default configurations of affected versions without special deployment requirements. Priority should be elevated for environments where: multiple administrator tiers exist, monitoring dashboards are frequently accessed, or regulatory compliance mandates prevention of privilege escalation paths. Organizations with single-admin setups face lower practical risk. Missing data: EPSS score, confirmed patch release versions, and POC availability limit precise risk quantification.

A malicious non-super administrator with legitimate Zabbix access creates a new maintenance period named 'Routine Update' but injects a JavaScript payload into the maintenance description field that captures session cookies and exfiltrates them to an attacker-controlled server. Days later, a super administrator reviewing host maintenance schedules hovers their mouse over the 'Routine Update' entry in the Host navigator widget to check details. The tooltip renders, executing the malicious script in the super admin's browser context. The script silently harvests the super admin's session token and sends it to the attacker, who then hijacks the super admin session to create a backdoor admin account, modify monitoring configurations to hide malicious activity, or exfiltrate sensitive infrastructure data visible in Zabbix. The victim notices no immediate indicators of compromise beyond the brief tooltip display.