CVE-2026-23930CWE-405

CVE-2026-23930

High · published August 18, 2026

CVSS v3.1

7.5

EPSS

Percentile

33.4

In the wild

Unconfirmed

What it is

An unauthenticated user is able to cause disproportionate CPU load on the Frontend webserver by sending specifically crafted requests to the Frontend popup.testtriggerexpr action, leading to potential denial of service.

The record

Technical detail

CVSS v3.1: 7.5 · HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0: 5.3 · CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
EPSS: 0.00403 · 33.4th percentile
Weakness: CWE-405 · Asymmetric Resource Consumption (Amplification)
Published: 2026-08-18T17:17Z

Affected products (3)

Product	Versions	Fixed in
zabbix/zabbix	≥ 6.0.0, < 6.0.47	6.0.47
zabbix/zabbix	≥ 7.0.0, < 7.0.27	7.0.27
zabbix/zabbix	≥ 7.4.0, < 7.4.11	7.4.11

References (1)

https://support.zabbix.com/browse/ZBX-28069 · [email protected]

EPSS history

Timeline

18 AUG 12:17Z
Frontend DoS via the popup.testtriggerexpr action
cvelistv5