CVE-2026-23920CWE-78command-injection

CVE-2026-23920

High · published March 24, 2026

CVSS v3.1

8.8

EPSS

Percentile

22.4

In the wild

Unconfirmed

What it is

Host and event action script input is validated with a regex (set by the administrator), but the validation runs in multiline mode. If ^ and $ anchors are used in user input validation, an injected newline lets authenticated users bypass the check and inject shell commands.

The record

Technical detail

CVSS v3.1: 8.8 · HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0: Not supplied
EPSS: 0.00308 · 22.4th percentile
Weakness: CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published: 2026-03-24T23:16Z

Affected products (3)

Product	Versions	Fixed in
zabbix/zabbix	≥ 7.0.0, < 7.0.22	7.0.22
zabbix/zabbix	≥ 7.2.0, < 7.2.15	7.2.15
zabbix/zabbix	≥ 7.4.0, < 7.4.6	7.4.6

References (1)

https://support.zabbix.com/browse/ZBX-27639 · [email protected]

EPSS history

Timeline

24 MAR 18:27Z
Host and event action script regex validation can be bypassed in certain situations, leading to potential command injection
cvelistv5