CVE-2026-23934CWE-405

CVE-2026-23934

Medium · published August 18, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
28.1
In the wild
Unconfirmed
What it is

An authenticated user is able to cause disproportionate CPU load on the Frontend webserver by sending specifically crafted requests to the Frontend validate.api.exists action, leading to potential denial of service.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
5.1 · CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
EPSS
0.00356 · 28.1th percentile
Weakness
CWE-405 · Asymmetric Resource Consumption (Amplification)
Published
2026-08-18T17:17Z
Affected products (1)
ProductVersionsFixed in
zabbix/zabbix≥ 7.4.0, < 7.4.127.4.12
References (1)
https://support.zabbix.com/browse/ZBX-28072 · [email protected]
EPSS history
Timeline
  • 18 AUG 12:18Z
    Frontend DoS via the validate.api.exists action
    cvelistv5