The Item history widget (in Zabbix 7.0+) or the Plain text widget (in Zabbix 6.0) can execute injected JavaScript when HTML display is enabled. This can allow an attacker to perform unauthorized actions depending on which user opens a dashboard containing these widgets. The malicious JavaScript would have to come from a monitored host controlled by the attacker. Note: the Item history widget is a replacement for the Plain text widget since Zabbix 7.0.

According to its self-reported version number, the version of Zabbix running on the remote host is 6.0.x prior to 6.0.45, or 7.0.x prior to 7.0.24, or 7.4.x prior to 7.4.8. It is, therefore, affected by multiple vulnerabilities :

- A stored cross-site scripting (XSS) vulnerability in the Host navigator widget maintenance tooltip, as an authenticated (non-super) administrator can create a maintenance period with a JavaScript payload that is executed by any user opening the tooltip for that maintenance period. (CVE-2026-23926)

- A stored cross-site scripting (XSS) vulnerability in the Item history widget (Zabbix 7.0 and later) or the Plain text widget (Zabbix 6.0), which can execute injected JavaScript when HTML display is enabled. The malicious JavaScript has to come from a monitored host controlled by the attacker. (CVE-2026-23928)

- An insufficiently protected credentials vulnerability in the Agent 2 Oracle plugin, as a user able to connect to Agent 2 can inject an Oracle TNS connection string via the 'service' parameter, causing Agent 2 to connect to an attacker-controlled server and leak Oracle database credentials saved in a named session. (CVE-2026-23927)

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Zabbix Server installed on the remote host is prior to 6.0.45, 7.0.24, 7.4.8. It is, therefore, affected by a stored cross-site scripting (XSS) vulnerability. The Item history widget (in Zabbix 7.0+) or the Plain text widget (in Zabbix 6.0) can execute injected JavaScript when HTML display is enabled. This can allow an attacker to perform unauthorized actions depending on which user opens a dashboard containing these widgets. The malicious JavaScript would have to come from a monitored host controlled by the attacker.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The Item history widget (in Zabbix 7.0+) or the Plain text widget (in Zabbix 6.0) can execute injected     JavaScript when HTML display is enabled. This can allow an attacker to perform unauthorized actions     depending on which user opens a dashboard containing these widgets. The malicious JavaScript would have to     come from a monitored host controlled by the attacker. Note: the Item history widget is a replacement for     the Plain text widget since Zabbix 7.0. (CVE-2026-23928)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
115513	Zabbix 7.4.x < 7.4.8 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	high
115512	Zabbix 7.0.x < 7.0.24 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	high
115511	Zabbix 6.0.x < 6.0.45 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	high
314956	Zabbix 6.0.x < 6.0.45 / 7.0.x < 7.0.24 / 7.4.x < 7.4.8 XSS (ZBX-27760)	Nessus	Misc.	Local	high
313144	Linux Distros Unpatched Vulnerability : CVE-2026-23928	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-23928

high

Tenable Plugins

high

high

high

high

high