CVE-2026-23938CWE-248

CVE-2026-23938

Medium · published August 18, 2026

CVSS v3.1

4.9

EPSS

Percentile

27.7

In the wild

Unconfirmed

What it is

An authenticated administrator is able to crash Zabbix server or proxy by creating specifically crafted preprocessing/script item JavaScript scripts, leading to potential denial of service.

The record

Technical detail

CVSS v3.1: 4.9 · MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0: 2.1 · CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
EPSS: 0.00352 · 27.7th percentile
Weakness: CWE-248 · Uncaught Exception
Published: 2026-08-18T17:17Z

Affected products (3)

Product	Versions	Fixed in
zabbix/zabbix	≥ 6.0.0, < 6.0.47	6.0.47
zabbix/zabbix	≥ 7.0.0, < 7.0.27	7.0.27
zabbix/zabbix	≥ 7.4.0, < 7.4.11	7.4.11

References (1)

https://support.zabbix.com/browse/ZBX-28075 · [email protected]

EPSS history

Timeline

18 AUG 12:20Z
Server DoS via JavaScript preprocessing or script items
cvelistv5