Zabbix Server EUVD-2026-92395

The attacker must hold a 'limited administrator' account on the Zabbix server (consistent with CVSS PR:H) and must be able to define or run a JavaScript preprocessing step, which uses the embedded Duktape engine - this feature must be in use for the heap data to be exposed. Exploitation is bounded by these factors: a valid privileged (though restricted) account is required, so this is not unauthenticated; the leaked data is limited to heap contents of other preprocessors running in the shared engine, meaning what is exposed depends on concurrent preprocessing activity; and there is no integrity or availability impact. This is a privilege-boundary / data-isolation bypass among administrators rather than an external remote compromise.

This is a moderate-severity information-disclosure issue, not a top-tier emergency. The vendor-supplied CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N) scores 6.9 (medium) and is internally consistent with the description: exploitation requires high privileges (PR:H - a 'limited administrator' account on the Zabbix server), has low attack complexity, needs no user interaction, and yields a high confidentiality impact with no integrity or availability impact. CWE-125 (out-of-bounds read) aligns with the 'read raw heap data' behavior. No EPSS score, no CISA KEV listing, and no public exploit were provided in the input, so exploitation status is: no public exploit identified at time of analysis. The key mitigating signal is PR:H - an attacker must already hold a privileged (if restricted) administrator account, which sharply narrows the realistic threat to insiders or post-compromise privilege-boundary escalation rather than mass remote exploitation. The signals are not conflicting: a high-confidentiality but privilege-gated flaw correctly lands in the medium band. The main caveat is data sparsity - only a single Zabbix tracker reference (ZBX-28193) was supplied, with no EPSS, no independent advisory detail, and no confirmed fixed version, so prioritization should be 'patch in normal cycle' rather than emergency unless the environment exposes the Zabbix admin interface to many semi-trusted users.

A user holding a limited (restricted) Zabbix administrator account configures an item with a JavaScript preprocessing step and uses it to trigger an out-of-bounds read in the Duktape engine, reading raw heap memory. Because preprocessors run in a shared process, the attacker can harvest sensitive data belonging to other preprocessing tasks they are not authorized to see, such as credentials or monitored values from other tenants or hosts. No public proof-of-concept was identified in the provided data; exploitation requires the attacker to already possess the limited-admin privilege indicated by PR:H.