Host and event action script input is validated with a regex (set by the administrator), but the validation runs in multiline mode. If ^ and $ anchors are used in user input validation, an injected newline lets authenticated users bypass the check and inject shell commands.

According to its self-reported version number, the version of Zabbix running on the remote host is 6.0.x prior to 6.0.44, or 7.0.x prior to 7.0.23, or 7.2.x prior to 7.2.15, or 7.4.x prior to 7.4.7. It is, therefore, affected by multiple vulnerabilities :

- A blind, read-only SQL injection vulnerability in include/classes/api/CApiService.php, as a low privilege user with API access can execute arbitrary SQL selects via the sortfield parameter. Although query results are not returned directly, an attacker can exfiltrate arbitrary database data through time-based techniques, potentially leading to session identifier disclosure and administrator account compromise. (CVE-2026-23921)

- An OS command injection vulnerability, as host and event action script input is validated with an administrator-defined regex that runs in multiline mode. If the ^ and $ anchors are used, an injected newline lets authenticated users bypass the check and inject shell commands. (CVE-2026-23920)

- An insufficient isolation of the JavaScript (Duktape) execution context on the Zabbix server and proxy, as contexts used by script items, JavaScript preprocessing and webhooks are reused for performance reasons. This can lead to a confidentiality loss where a regular (non-super) administrator leaks data for hosts they do not have access to. (CVE-2026-23919)

- An unsafe reflection vulnerability, as an unauthenticated attacker can exploit the frontend 'validate' action to blindly instantiate arbitrary PHP classes. (CVE-2026-23923)

- An argument injection vulnerability in the Agent 2 Docker plugin, which does not properly sanitize the 'docker.container_info' parameters when forwarding them to the Docker daemon, allowing an attacker able to invoke Agent 2 to read arbitrary files from running Docker containers. (CVE-2026-23924)

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Zabbix Server installed on the remote host is prior to 7.0.22, 7.2.15, 7.4.6. It is, therefore, affected by multiple vulnerabilities :

  - A blind SQL injection vulnerability exists in the Zabbix API via the sortfield parameter in     include/classes/api/CApiService.php. A low privilege Zabbix user with API access can exploit this to execute     arbitrary SQL selects. Although query results are not returned directly, an attacker can exfiltrate arbitrary     database data through time-based techniques, potentially leading to session identifier disclosure and     administrator account compromise. (CVE-2026-23921)

  - A command injection vulnerability exists in host and event action script input validation due to the regex     validation running in multiline mode. An authenticated, remote attacker can exploit this, via a newline     injection, to bypass input validation and inject shell commands. (CVE-2026-23920)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Host and event action script input is validated with a regex (set by the administrator), but the     validation runs in multiline mode. If ^ and $ anchors are used in user input validation, an injected     newline lets authenticated users bypass the check and inject shell commands. (CVE-2026-23920)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
115517	Zabbix 7.4.x < 7.4.7 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	high
115516	Zabbix 7.2.x < 7.2.15 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	high
115515	Zabbix 7.0.x < 7.0.23 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	high
115514	Zabbix 6.0.x < 6.0.44 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	high
304677	Zabbix 7.0.x < 7.0.22 / 7.2.x < 7.2.15 / 7.4.x < 7.4.6 Multiple Vulnerabilities (ZBX-27639)	Nessus	Misc.	Local	high
304005	Linux Distros Unpatched Vulnerability : CVE-2026-23920	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-23920

high

Tenable Plugins

high

high

high

high

high

high