CVE-2026-23921CWE-89sql-injection

CVE-2026-23921

High · published March 24, 2026

CVSS v3.1
8.8
EPSS
4%
Percentile
90.7
In the wild
Unconfirmed
What it is

A low privilege Zabbix user with API access can exploit a blind SQL injection vulnerability in include/classes/api/CApiService.php to execute arbitrary SQL selects via the sortfield parameter. Although query results are not returned directly, an attacker can exfiltrate arbitrary database data through time-based techniques, potentially leading to session identifier disclosure and administrator account compromise.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.04094 · 90.7th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2026-03-24T23:16Z
Affected products (3)
ProductVersionsFixed in
zabbix/zabbix≥ 7.0.0, < 7.0.227.0.22
zabbix/zabbix≥ 7.2.0, < 7.2.157.2.15
zabbix/zabbix≥ 7.4.0, < 7.4.67.4.6
References (1)
https://support.zabbix.com/browse/ZBX-27640 · [email protected]
EPSS history
Timeline
  • 24 MAR 18:28Z
    Blind, read-only SQL injection in Zabbix API via sortfield parameter
    cvelistv5