CVE-2026-23935 Overview
CVE-2026-23935 is an out-of-bounds read vulnerability [CWE-125] in Zabbix. A Zabbix administrator can trigger the flaw through the script item and preprocessing (JavaScript) HttpRequest logic. Successful exploitation reads memory beyond intended buffer boundaries, exposing sensitive process data. The issue affects confidentiality but does not impact integrity or availability. Exploitation requires high privileges on the Zabbix server and adjacent network access.
Critical Impact
An authenticated administrator can read out-of-bounds memory from the Zabbix server process, potentially exposing credentials, tokens, or other sensitive data held in memory.
Affected Products
- Zabbix (script item and preprocessing components using JavaScript HttpRequest)
- See the Zabbix Issue Tracker ZBX-28073 for specific version details
- Deployments where administrator accounts can define script items or preprocessing steps
Discovery Timeline
- 2026-08-18 - CVE-2026-23935 published to NVD
- 2026-08-18 - Last updated in NVD database
Technical Details for CVE-2026-23935
Vulnerability Analysis
The vulnerability resides in the JavaScript HttpRequest object used by Zabbix script items and preprocessing steps. The implementation fails to properly validate buffer boundaries when processing HTTP request data. An administrator with permission to define or edit script items can craft input that causes the engine to read memory beyond the allocated buffer.
The returned data may include fragments of adjacent heap memory belonging to the Zabbix server process. This memory can contain authentication tokens, API keys, database credentials, or other secrets processed by the server. The vulnerability is classified as an out-of-bounds read [CWE-125].
Exploitation requires adjacent network access and high privileges. The scope remains within the vulnerable component and does not escalate to other systems. Only confidentiality is affected; the flaw does not allow modification or denial of service.
Root Cause
The root cause is missing or incorrect boundary validation in the JavaScript HttpRequest handler within Zabbix. The engine trusts input length parameters or offsets without verifying them against the actual allocated buffer size. See the Zabbix Issue Tracker ZBX-28073 for vendor technical details.
Attack Vector
An attacker must first obtain Zabbix administrator credentials. From an adjacent network position, the attacker creates or modifies a script item or JavaScript preprocessing step. The malicious script invokes HttpRequest methods with crafted arguments that trigger the out-of-bounds read. The disclosed memory is returned through script output or item value, where the administrator can retrieve it.
No verified public exploit code is available. Refer to the Zabbix Issue Tracker ZBX-28073 for technical details.
Detection Methods for CVE-2026-23935
Indicators of Compromise
- Unexpected creation or modification of script items and preprocessing steps by administrator accounts
- Script item output containing binary data or unexpected string fragments inconsistent with normal HTTP responses
- JavaScript preprocessing scripts invoking HttpRequest methods with unusual length or offset parameters
Detection Strategies
- Audit Zabbix configuration changes, focusing on script items and preprocessing definitions authored recently
- Review Zabbix server logs for JavaScript execution errors or anomalies tied to HttpRequest calls
- Correlate administrative logins with subsequent script item modifications from adjacent network sources
Monitoring Recommendations
- Enable Zabbix audit logging and forward events to a central SIEM for review
- Monitor for administrator sessions originating from unexpected network segments
- Alert on newly created script items that return large or unusual payloads to item history
How to Mitigate CVE-2026-23935
Immediate Actions Required
- Apply the patched Zabbix version referenced in ZBX-28073 once available
- Restrict administrator accounts to trusted personnel and enforce multi-factor authentication
- Review all existing script items and preprocessing scripts for unexpected HttpRequest usage
Patch Information
Refer to the Zabbix Issue Tracker ZBX-28073 for patched version details and upgrade instructions. Apply the vendor-supplied update to all Zabbix server and proxy instances.
Workarounds
- Limit the number of accounts granted Zabbix Super Admin privileges
- Restrict network access to the Zabbix frontend and API to trusted management networks only
- Disable or tightly control the ability to create JavaScript-based script items and preprocessing steps until patched
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
