CVE-2026-23938: Zabbix Server DoS Vulnerability

CVE-2026-23938 Overview

CVE-2026-23938 is a denial of service vulnerability affecting Zabbix server and proxy components. An authenticated administrator can crash the Zabbix server or proxy by creating specifically crafted preprocessing or script item JavaScript scripts. The flaw is categorized as an uncaught exception issue under [CWE-248]. Exploitation requires administrative privileges, which limits the practical attack surface but does not eliminate risk from insider misuse or compromised administrator credentials. The vulnerability affects monitoring availability, a core function of the Zabbix platform.

Critical Impact
An authenticated administrator can crash Zabbix server or proxy processes through malicious JavaScript in preprocessing or script items, disrupting monitoring services.

Affected Products

Zabbix Server
Zabbix Proxy
Zabbix deployments using JavaScript preprocessing or script items

Discovery Timeline

2026-08-18 - CVE-2026-23938 published to NVD
2026-08-18 - Last updated in NVD database

Technical Details for CVE-2026-23938

Vulnerability Analysis

The vulnerability resides in the JavaScript execution path used by Zabbix preprocessing steps and script items. Zabbix allows administrators to define JavaScript code that transforms collected metric data or executes custom logic. When the embedded JavaScript engine processes a specifically crafted script, an uncaught exception propagates and terminates the server or proxy process.

The root weakness [CWE-248] describes an uncaught exception that reaches an execution boundary where no handler exists. In Zabbix, this results in process termination and loss of monitoring functionality. Because Zabbix server and proxy are single points of monitoring in most deployments, a crash disrupts data collection, alerting, and dependent automation workflows.

Root Cause

The Zabbix JavaScript execution subsystem fails to catch specific exception conditions triggered by malformed or malicious script constructs. The unhandled exception bubbles up through the runtime and terminates the parent process instead of returning a script-level error.

Attack Vector

Exploitation requires network access to the Zabbix frontend and valid administrator credentials. The attacker creates or modifies a preprocessing step or script item with crafted JavaScript. When Zabbix executes the script during normal metric collection, the server or proxy crashes. Refer to the Zabbix Issue Tracker ZBX-28075 for vendor-tracked technical details.

No verified public exploit code is available at this time. The Exploit Prediction Scoring System (EPSS) rates the near-term exploitation probability as low.

Detection Methods for CVE-2026-23938

Indicators of Compromise

Unexpected termination or repeated restarts of zabbix_server or zabbix_proxy processes.
New or recently modified preprocessing steps or script items containing unusual JavaScript constructs.
Gaps in metric collection or delayed alert delivery following administrator configuration changes.

Detection Strategies

Audit Zabbix configuration change logs for creation or modification of JavaScript preprocessing and script items by administrator accounts.
Correlate process crash events with recent script or preprocessing changes in the Zabbix database.
Monitor the Zabbix server and proxy logs for exception traces and abnormal termination messages.

Monitoring Recommendations

Enable external process monitoring for zabbix_server and zabbix_proxy availability with alerting on unexpected exits.
Track administrator API and frontend actions that touch item preprocessing and script item objects.
Review authentication logs for anomalous administrator sessions preceding configuration changes.

How to Mitigate CVE-2026-23938

Immediate Actions Required

Restrict administrator role assignment to a minimal set of trusted operators and enforce multi-factor authentication on all Zabbix administrator accounts.
Review all existing preprocessing steps and script items for unexpected or recently modified JavaScript content.
Enable configuration change auditing and alert on modifications to script-bearing item types.

Patch Information

Consult the Zabbix Issue Tracker ZBX-28075 for the current patch status and fixed version information. Apply vendor-provided updates as soon as they are available in your environment.

Workarounds

Limit which administrator accounts can create or modify JavaScript preprocessing and script items through role-based access controls.
Implement a change-review process that requires peer approval before script items are deployed to production.
Deploy Zabbix proxies in segmented tiers so that a crash in one proxy does not affect the entire monitoring estate.

bash

# Configuration example: audit users with administrator privileges
# Run against the Zabbix database to enumerate super-admin users
SELECT userid, username, roleid FROM users WHERE roleid IN (
  SELECT roleid FROM role WHERE type = 3
);