PT-2026-27476 · Red Os · Red Os

Janis Nulle + 1 · Published 2026-03-24 · Updated 2026-05-05 · CVE-2026-23923

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions The product name cannot be determined (affected versions not specified)

Description An unauthenticated attacker can exploit the 'validate' action in the Frontend to blindly instantiate arbitrary PHP classes. The impact of this issue depends on the environment setup and currently appears limited.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Weakness Enumeration

CWE-470

Related Identifiers

BDU:2026-07353

CVE-2026-23923

Affected Products

Red Os

References · 6

• https://bdu.fstec.ru/vul/2026-07353 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-23923 · Security Note
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti-red-os-8-0/uyazvimost-zabbix7-4-cve-2026-23923-8.0 · Note
• https://redos.red-soft.ru/search/?iblock_id=24&q=CVE-2026-23923 · Note
• https://support.zabbix.com/browse/ZBX-27641 · Note
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/uyazvimost-zabbix7-4-cve-2026-23923-7.3 · Note