The Zabbix API host.get action can be exploited by authenticated users to extract a host's PSK key leading to potential loss of data integrity.

According to its self-reported version number, the version of Zabbix running on the remote host is 6.0.x prior to 6.0.48, or 7.0.x prior to 7.0.29, or 7.4.x prior to 7.4.13. It is, therefore, affected by multiple vulnerabilities :

- A prototype pollution vulnerability in searchParamsToObject() leading to a persistent cross-site scripting (XSS) in Maps, as URL parameter processing did not filter dangerous properties such as __proto__, combined with an unsafe jQuery element creation that traversed the prototype chain. (CVE-2026-23929)

- A hardcoded session key, as in Zabbix 7.4 the cryptographic key used for signing frontend sessions was erroneously written to the database seed. In deployments using both SAML authentication and guest users, the key can be used to forge valid session cookies, potentially leading to unauthorized access. (CVE-2026-23933)

- A denial of service vulnerability, as an unauthenticated user is able to cause disproportionate CPU load on the frontend webserver by sending specifically crafted requests to the popup.testtriggerexpr action. (CVE-2026-23930)

- A denial of service vulnerability, as an authenticated user is able to cause disproportionate CPU load on the frontend webserver by sending specifically crafted requests to the validate.api.exists action. (CVE-2026-23934)

- An information disclosure vulnerability, as the frontend validatate.api.exists action can be exploited by authenticated users to extract plaintext user macro values. (CVE-2026-23931)

- An information disclosure vulnerability, as the API host.get action can be exploited by authenticated users to extract a host's PSK key, leading to a potential loss of data integrity. (CVE-2026-23937)

- An out-of-bounds read vulnerability, as a Zabbix administrator is able to read out of bounds memory by utilizing a flaw in the script item/preprocessing (JavaScript) HttpRequest logic. (CVE-2026-23935)

- A race condition in the API and frontend login lockout mechanism, where several unsuccessful login requests are not properly counted towards the block counter if sent simultaneously, potentially allowing for more password guesses than intended. (CVE-2026-1199)

- An insufficiently protected credentials vulnerability, as the email media OAuth 'Client secret' field cannot be read after saving but can be leaked by a Super Admin setting a malicious 'Token endpoint'. (CVE-2026-23922)

- A denial of service vulnerability, as an authenticated administrator is able to crash the Zabbix server or proxy by creating specifically crafted preprocessing/script item JavaScript scripts. (CVE-2026-23938)

- An uncontrolled search path element vulnerability, as the Windows agent installer did not verify whether a custom installation directory had secure access permissions, increasing the risk of DLL sideloading. (CVE-2026-59781)

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The Zabbix API host.get action can be exploited by authenticated users to extract a host's PSK key leading     to potential loss of data integrity. (CVE-2026-23937)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
115510	Zabbix 7.4.x < 7.4.13 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	high
115509	Zabbix 7.0.x < 7.0.29 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	high
115508	Zabbix 6.0.x < 6.0.48 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	high
338040	Linux Distros Unpatched Vulnerability : CVE-2026-23937	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-23937

medium

Tenable Plugins

high

high

high

medium