An authenticated (non-super) administrator can create a maintenance period with a JavaScript payload that is executed by any user that opens tooltip for that maintenance period in the Host navigator widget. This can allow the attacker to perform unauthorized actions depending on which user opens the tooltip.

According to its self-reported version number, the version of Zabbix running on the remote host is 6.0.x prior to 6.0.45, or 7.0.x prior to 7.0.24, or 7.4.x prior to 7.4.8. It is, therefore, affected by multiple vulnerabilities :

- A stored cross-site scripting (XSS) vulnerability in the Host navigator widget maintenance tooltip, as an authenticated (non-super) administrator can create a maintenance period with a JavaScript payload that is executed by any user opening the tooltip for that maintenance period. (CVE-2026-23926)

- A stored cross-site scripting (XSS) vulnerability in the Item history widget (Zabbix 7.0 and later) or the Plain text widget (Zabbix 6.0), which can execute injected JavaScript when HTML display is enabled. The malicious JavaScript has to come from a monitored host controlled by the attacker. (CVE-2026-23928)

- An insufficiently protected credentials vulnerability in the Agent 2 Oracle plugin, as a user able to connect to Agent 2 can inject an Oracle TNS connection string via the 'service' parameter, causing Agent 2 to connect to an attacker-controlled server and leak Oracle database credentials saved in a named session. (CVE-2026-23927)

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - An authenticated (non-super) administrator can create a maintenance period with a JavaScript payload that     is executed by any user that opens tooltip for that maintenance period in the Host navigator widget. This     can allow the attacker to perform unauthorized actions depending on which user opens the tooltip.
    (CVE-2026-23926)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of Zabbix Server installed on the remote host is prior to 7.0.24, 7.4.8. It is, therefore, affected by a stored cross-site scripting (XSS) vulnerability. An authenticated (non-super) administrator can create a maintenance period with a JavaScript payload that is executed by any user that opens tooltip for that maintenance period in the Host navigator widget. This can allow the attacker to perform unauthorized actions depending on which user opens the tooltip.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
115513	Zabbix 7.4.x < 7.4.8 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	high
115512	Zabbix 7.0.x < 7.0.24 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	high
115511	Zabbix 6.0.x < 6.0.45 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	high
315210	Linux Distros Unpatched Vulnerability : CVE-2026-23926	Nessus	Misc.	Local	high
314955	Zabbix 7.0.x < 7.0.24 / 7.4.x < 7.4.8 XSS (ZBX-27758)	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-23926

high

Tenable Plugins

high

high

high

high

high