CVE-2026-59781: Zabbix Agent DLL Sideloading Vulnerability

CVE-2026-59781 Overview

CVE-2026-59781 affects the Zabbix Agent installer for Windows when deployed to a custom installation directory. The installer did not verify whether the target directory enforced secure access permissions. When an administrator selected a directory writable by unauthorized users, an attacker with local write access could place a malicious dynamic-link library (DLL) into that path. The Zabbix Agent could then load the attacker-controlled DLL during execution, resulting in DLL sideloading [CWE-427]. The vendor has hardened the installer to detect unsafe directories and require explicit user confirmation before proceeding.

Critical Impact
Local attackers with write access to an insecure Zabbix Agent installation directory can execute arbitrary code in the context of the agent process through DLL sideloading.

Affected Products

Zabbix Agent for Windows installed to custom directories with insecure permissions
Deployments where the installation path grants write access to non-administrative users
Systems using the affected Windows installer prior to the hardening fix

Discovery Timeline

2026-08-18 - CVE-2026-59781 published to NVD
2026-08-19 - Last updated in NVD database

Technical Details for CVE-2026-59781

Vulnerability Analysis

The vulnerability is a classic uncontrolled search path element issue [CWE-427] affecting the Windows installer for the Zabbix Agent. During installation to a custom directory, the installer accepts the administrator-provided path without validating the access control list (ACL) applied to that directory. When the Zabbix Agent process later starts, Windows resolves DLL dependencies using its standard search order, which includes the application's installation directory. Any DLL placed in that directory by a low-privileged user can be loaded by the agent.

Because the Zabbix Agent typically runs as a Windows service with elevated privileges, code loaded through this path executes with those privileges. This produces a local privilege escalation primitive when the agent runs as LocalSystem or another privileged account.

Root Cause

The installer omits ACL verification for the destination directory. Windows creates directories under paths such as C:\ or user-writable locations with permissive inherited permissions by default. Non-privileged users on the host can drop files into those locations. The application then trusts its own installation directory when resolving DLL imports.

Attack Vector

Exploitation requires local access and a Zabbix Agent installation placed in a directory writable by the attacker. The attacker writes a crafted DLL matching a name the agent loads. On the next agent start or service restart, the malicious library is loaded into the agent process. See the Zabbix Bug Report ZBX-28077 for vendor details.

Detection Methods for CVE-2026-59781

Indicators of Compromise

Unexpected DLL files appearing in the Zabbix Agent installation directory that are not part of the official distribution
Zabbix Agent service loading modules from non-standard paths as observed in process image load events
Zabbix Agent installation paths located outside C:\Program Files or other ACL-restricted locations

Detection Strategies

Inventory all Windows hosts running Zabbix Agent and record the installation directory for each
Audit directory ACLs on each installation path and flag any that grant write permission to non-administrative principals
Monitor Windows Sysmon Event ID 7 (Image Loaded) for zabbix_agentd.exe and correlate loaded module paths against a known-good baseline

Monitoring Recommendations

Enable file integrity monitoring on Zabbix Agent installation directories to alert on new or modified DLL files
Log service start events for the Zabbix Agent and review loaded module lists after each restart
Alert on any process creation where zabbix_agentd.exe spawns unexpected child processes or interacts with lolbins

How to Mitigate CVE-2026-59781

Immediate Actions Required

Identify Zabbix Agent installations placed in non-standard directories and verify the ACL on each installation path
Reinstall the Zabbix Agent into a directory that restricts write access to administrators only, such as C:\Program Files\Zabbix Agent
Update to the hardened installer that detects unsafe installation directories and requires explicit confirmation

Patch Information

Zabbix has hardened the Windows installer to detect potentially unsafe installation directories and prompt for explicit user confirmation before continuing. Refer to the Zabbix Bug Report ZBX-28077 for the fixed installer versions and release notes.

Workarounds

Restrict the ACL on the existing Zabbix Agent installation directory so only Administrators and SYSTEM can write to it
Remove Modify and Write permissions granted to Users, Authenticated Users, or Everyone on the installation path
Restrict local logon rights on servers running the Zabbix Agent to reduce the pool of principals capable of dropping DLLs

bash

# Configuration example: restrict ACL on the Zabbix Agent installation directory
icacls "C:\Zabbix\Agent" /inheritance:r
icacls "C:\Zabbix\Agent" /grant:r "Administrators:(OI)(CI)F" "SYSTEM:(OI)(CI)F" "Users:(OI)(CI)RX"
icacls "C:\Zabbix\Agent" /remove "Everyone" "Authenticated Users"