An unauthenticated attacker can exploit the Frontend 'validate' action to blindly instantiate arbitrary PHP classes. The impact depends on environment setup but appears limited at this time.

According to its self-reported version number, the version of Zabbix running on the remote host is 6.0.x prior to 6.0.44, or 7.0.x prior to 7.0.23, or 7.2.x prior to 7.2.15, or 7.4.x prior to 7.4.7. It is, therefore, affected by multiple vulnerabilities :

- A blind, read-only SQL injection vulnerability in include/classes/api/CApiService.php, as a low privilege user with API access can execute arbitrary SQL selects via the sortfield parameter. Although query results are not returned directly, an attacker can exfiltrate arbitrary database data through time-based techniques, potentially leading to session identifier disclosure and administrator account compromise. (CVE-2026-23921)

- An OS command injection vulnerability, as host and event action script input is validated with an administrator-defined regex that runs in multiline mode. If the ^ and $ anchors are used, an injected newline lets authenticated users bypass the check and inject shell commands. (CVE-2026-23920)

- An insufficient isolation of the JavaScript (Duktape) execution context on the Zabbix server and proxy, as contexts used by script items, JavaScript preprocessing and webhooks are reused for performance reasons. This can lead to a confidentiality loss where a regular (non-super) administrator leaks data for hosts they do not have access to. (CVE-2026-23919)

- An unsafe reflection vulnerability, as an unauthenticated attacker can exploit the frontend 'validate' action to blindly instantiate arbitrary PHP classes. (CVE-2026-23923)

- An argument injection vulnerability in the Agent 2 Docker plugin, which does not properly sanitize the 'docker.container_info' parameters when forwarding them to the Docker daemon, allowing an attacker able to invoke Agent 2 to read arbitrary files from running Docker containers. (CVE-2026-23924)

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Zabbix Server installed on the remote host is affected by a vulnerability. An unauthenticated attacker can exploit the Frontend 'validate' action to blindly instantiate arbitrary PHP classes. The impact depends on environment setup but appears limited at this time.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
115517	Zabbix 7.4.x < 7.4.7 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	high
115516	Zabbix 7.2.x < 7.2.15 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	high
115515	Zabbix 7.0.x < 7.0.23 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	high
115514	Zabbix 6.0.x < 6.0.44 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	high
304681	Zabbix 7.4.x < 7.4.7 Arbitrary PHP Class Instantiation (ZBX-27641)	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-23923

medium

Tenable Plugins

high

high

high

high

medium