CVE-2025-27240: Zabbix SQL Injection Vulnerability

CVE-2025-27240 Overview

CVE-2025-27240 is a SQL injection vulnerability in Zabbix, the open-source enterprise monitoring platform. An authenticated administrator can inject arbitrary SQL statements during the autoremoval process of hosts by placing malicious payloads in the Visible name field. The vulnerability is tracked under CWE-89: Improper Neutralization of Special Elements used in an SQL Command and is documented in Zabbix Support Issue ZBX-26986.

Critical Impact
An attacker with administrator privileges can execute arbitrary SQL against the Zabbix database, leading to full disclosure, modification, or deletion of monitoring data and credentials.

Affected Products

Zabbix monitoring server (multiple versions — see vendor advisory ZBX-26986)
Zabbix frontend host management component
Zabbix autoremoval workflow processing the Visible name field

Discovery Timeline

2025-09-12 - CVE-2025-27240 published to the National Vulnerability Database
2025-10-08 - Last updated in NVD database

Technical Details for CVE-2025-27240

Vulnerability Analysis

The flaw resides in the Zabbix host management workflow. When the server processes the autoremoval of hosts, it incorporates the Visible name attribute into a SQL statement without sufficient sanitization or parameterization. An administrator who sets a host's visible name to a crafted string can break out of the intended SQL context and append arbitrary statements.

Because Zabbix stores credentials, monitoring telemetry, action configurations, and user data in the same backend database, successful injection compromises the confidentiality, integrity, and availability of the entire monitoring estate. The Exploit Prediction Scoring System (EPSS) places this issue above many comparable injection flaws in observed exploitation likelihood.

Root Cause

The root cause is unsafe construction of SQL queries from user-controlled input. The autoremoval path concatenates the Visible name value into a dynamically built query rather than binding it as a parameter. This violates the secure coding guidance described under CWE-89.

Attack Vector

Exploitation requires high privileges — an attacker must already hold a Zabbix administrator account or have compromised one. The attacker creates or edits a host and stores a SQL payload in the Visible name field. When the autoremoval routine subsequently processes that host, the payload executes against the database. The attack is delivered over the network through the Zabbix frontend, requires no user interaction, and yields high impact on confidentiality, integrity, and availability of the database.

No public proof-of-concept code is available at this time. Refer to the Zabbix Support Issue ZBX-26986 for vendor-supplied technical details.

Detection Methods for CVE-2025-27240

Indicators of Compromise

Host entries containing SQL meta-characters such as single quotes, semicolons, or UNION SELECT fragments inside the Visible name field.
Unexpected database errors logged by the Zabbix server around host autoremoval operations.
Anomalous read or write activity against Zabbix database tables (users, sessions, hosts) originating from the Zabbix application user.

Detection Strategies

Audit the Zabbix hosts table for visible names containing SQL syntax tokens and review change history for administrator accounts that created them.
Enable database query logging on the Zabbix backend and alert on multi-statement queries or comment markers (--, /*) originating from the Zabbix service account.
Correlate Zabbix audit log entries for host edits with subsequent autoremoval events to surface suspicious sequences.

Monitoring Recommendations

Monitor administrator account creation, privilege grants, and authentication anomalies on the Zabbix frontend.
Track outbound connections from the Zabbix server host that deviate from established monitoring baselines.
Alert on backup, dump, or export operations executed against the Zabbix database outside of scheduled maintenance windows.

How to Mitigate CVE-2025-27240

Immediate Actions Required

Apply the Zabbix security update referenced in ZBX-26986 as soon as it is available for your release branch.
Review all existing Zabbix administrator accounts and revoke unused or shared credentials.
Audit the hosts table for any current Visible name values containing SQL syntax and remove or neutralize them.

Patch Information

Zabbix has acknowledged the issue under tracker ZBX-26986. Administrators should consult the advisory for the list of fixed versions and upgrade their Zabbix server, frontend, and proxy components to a patched release.

Workarounds

Restrict administrative access to the Zabbix frontend using network controls such as VPN, allow-listed source IPs, or reverse proxy authentication.
Enforce multi-factor authentication on all Zabbix administrator accounts to reduce the risk of account takeover.
Apply the principle of least privilege so that host configuration permissions are granted only to operators who require them.
Increase database audit logging on the Zabbix backend to capture queries issued by the Zabbix service account for forensic review.

bash

# Example: identify suspicious host visible names containing SQL meta-characters
# Run against the Zabbix database (read-only review query)
SELECT hostid, host, name
FROM hosts
WHERE name LIKE '%;%'
   OR name LIKE '%--%'
   OR name LIKE '%/*%'
   OR name LIKE '%UNION%'
   OR name LIKE '%SELECT%';