According to its self-reported version number, the version of Zabbix running on the remote host is 6.0.x prior to 6.0.45, or 7.0.x prior to 7.0.24, or 7.4.x prior to 7.4.8. It is, therefore, affected by multiple vulnerabilities :

- A stored cross-site scripting (XSS) vulnerability in the Host navigator widget maintenance tooltip, as an authenticated (non-super) administrator can create a maintenance period with a JavaScript payload that is executed by any user opening the tooltip for that maintenance period. (CVE-2026-23926)

- A stored cross-site scripting (XSS) vulnerability in the Item history widget (Zabbix 7.0 and later) or the Plain text widget (Zabbix 6.0), which can execute injected JavaScript when HTML display is enabled. The malicious JavaScript has to come from a monitored host controlled by the attacker. (CVE-2026-23928)

- An insufficiently protected credentials vulnerability in the Agent 2 Oracle plugin, as a user able to connect to Agent 2 can inject an Oracle TNS connection string via the 'service' parameter, causing Agent 2 to connect to an attacker-controlled server and leak Oracle database credentials saved in a named session. (CVE-2026-23927)

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A user able to connect to Agent 2 can inject an Oracle TNS connection string via the 'service' parameter.
    This can lead to Agent 2 connecting to an attacker-controlled server and leaking Oracle database     credentials if they are saved in a named session. (CVE-2026-23927)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Published	Updated	Severity
115511	Zabbix 6.0.x < 6.0.45 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	9/23/2026	9/23/2026	high
115513	Zabbix 7.4.x < 7.4.8 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	9/23/2026	9/23/2026	high
115512	Zabbix 7.0.x < 7.0.24 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	9/23/2026	9/23/2026	high
315209	Linux Distros Unpatched Vulnerability : CVE-2026-23927	Nessus	Misc.	5/18/2026	9/2/2026	medium

Detections

Analytics

Plugins Search

high

high

high

medium