For performance reasons Zabbix Server/Proxy reuses JavaScript (Duktape) contexts (used in script items, JavaScript reprocessing, Webhooks). This can lead to confidentiality loss where a regular (non-super) Zabbix administrator leaks data for hosts they do not have access to. A fix has been released that makes the built in Zabbix JavaScript objects read-only, but please be advised that usage of global JavaScript variables is not recommended because their content could be leaked. More information <a href='https://www.zabbix.com/documentation/7.4/en/manual/installation/known_issues#preprocessing-global-variables-are-unsafe'>in Zabbix documentation</a>.

According to its self-reported version number, the version of Zabbix running on the remote host is 6.0.x prior to 6.0.44, or 7.0.x prior to 7.0.23, or 7.2.x prior to 7.2.15, or 7.4.x prior to 7.4.7. It is, therefore, affected by multiple vulnerabilities :

- A blind, read-only SQL injection vulnerability in include/classes/api/CApiService.php, as a low privilege user with API access can execute arbitrary SQL selects via the sortfield parameter. Although query results are not returned directly, an attacker can exfiltrate arbitrary database data through time-based techniques, potentially leading to session identifier disclosure and administrator account compromise. (CVE-2026-23921)

- An OS command injection vulnerability, as host and event action script input is validated with an administrator-defined regex that runs in multiline mode. If the ^ and $ anchors are used, an injected newline lets authenticated users bypass the check and inject shell commands. (CVE-2026-23920)

- An insufficient isolation of the JavaScript (Duktape) execution context on the Zabbix server and proxy, as contexts used by script items, JavaScript preprocessing and webhooks are reused for performance reasons. This can lead to a confidentiality loss where a regular (non-super) administrator leaks data for hosts they do not have access to. (CVE-2026-23919)

- An unsafe reflection vulnerability, as an unauthenticated attacker can exploit the frontend 'validate' action to blindly instantiate arbitrary PHP classes. (CVE-2026-23923)

- An argument injection vulnerability in the Agent 2 Docker plugin, which does not properly sanitize the 'docker.container_info' parameters when forwarding them to the Docker daemon, allowing an attacker able to invoke Agent 2 to read arbitrary files from running Docker containers. (CVE-2026-23924)

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Zabbix Server installed on the remote host is prior to 6.0.41, 7.0.19, 7.2.13, 7.4.3. It is, therefore, affected by an information disclosure vulnerability :

  - Zabbix Server/Proxy reuses JavaScript (Duktape) contexts for performance reasons. This can lead to     confidentiality loss where a regular (non-super) Zabbix administrator leaks data for hosts they do not have     access to. (CVE-2026-23919)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - For performance reasons Zabbix Server/Proxy reuses JavaScript (Duktape) contexts (used in script items,     JavaScript reprocessing, Webhooks). This can lead to confidentiality loss where a regular (non-super)     Zabbix administrator leaks data for hosts they do not have access to. A fix has been released that makes     the built in Zabbix JavaScript objects read-only, but please be advised that usage of global JavaScript     variables is not recommended because their content could be leaked. More information <a     href='https://www.zabbix.com/documentation/7.4/en/manual/installation/known_issues#preprocessing-global-     variables-are-unsafe'>in Zabbix documentation</a>. (CVE-2026-23919)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
115517	Zabbix 7.4.x < 7.4.7 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	high
115516	Zabbix 7.2.x < 7.2.15 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	high
115515	Zabbix 7.0.x < 7.0.23 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	high
115514	Zabbix 6.0.x < 6.0.44 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	high
304682	Zabbix 6.0.x < 6.0.41 / 7.0.x < 7.0.19 / 7.2.x < 7.2.13 / 7.4.x < 7.4.3 Information Disclosure (ZBX-27638)	Nessus	Misc.	Local	high
304003	Linux Distros Unpatched Vulnerability : CVE-2026-23919	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-23919

high

Tenable Plugins

high

high

high

high

high

high