PT-2026-27473 · Zabbix+1 · Zabbix+1

Big_John · Published 2026-03-24 · Updated 2026-04-17 · CVE-2026-23919

Positive Technologies (AI Summary)

CVSS v4.0

7.1

High

Base vector

AV:A/AC:L/AT:P/PR:H/UI:N/VC:H/VI:L/VA:L/SC:H/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Zabbix versions prior to 7.4

Description A design flaw in Zabbix Server/Proxy related to JavaScript (Duktape) context reuse can result in data leakage. Specifically, a regular Zabbix administrator may unintentionally expose data for hosts they are not authorized to access. The issue stems from the way JavaScript contexts are handled during script item processing, JavaScript reprocessing, and Webhooks. A fix has been implemented to make built-in Zabbix JavaScript objects read-only, but the use of global JavaScript variables is discouraged as their content could still be exposed.

Recommendations Update to Zabbix version 7.4 or later. Avoid using global JavaScript variables.

Fix

Weakness Enumeration

CWE-488

Related Identifiers

BDU:2026-07354

CVE-2026-23919

Affected Products

Red Os

Zabbix

References · 18

• https://security-tracker.debian.org/tracker/CVE-2026-23919 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-23919 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-23919 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-23919 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-23919 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-23919 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-07354 · Security Note
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti-red-os-8-0/uyazvimost-zabbix-lts-cve-2026-23919-8.0 · Note
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/uyazvimost-zabbix7-lts-cve-2026-23919-7.3 · Note
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/uyazvimost-zabbix7-4-cve-2026-23919-7.3 · Note
• https://twitter.com/autumn_good_35/status/2037538031234941217 · Twitter Post
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/uyazvimost-zabbix7-2-cve-2026-23919-7.3 · Note
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/uyazvimost-zabbix-lts-cve-2026-23919-7.3 · Note
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti-red-os-8-0/uyazvimost-zabbix7-lts-cve-2026-23919-8.0 · Note
• https://redos.red-soft.ru/search/?iblock_id=24&q=CVE-2026-23919 · Note