CVE-2026-59786

Awaiting Analysis Awaiting Analysis - Queue

BaseFortify

Publication date: 2026-10-05

Last updated on: 2026-10-06

Assigner: Zabbix

Description

Zabbix Server and Proxy accept the active agent heartbeat message regardless of the configured PSK or certificate authentication. This means someone with access to the Zabbix trapper port can report an arbitrary host using an active agent as available, resulting in a loss of integrity.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-05

Last Modified

2026-10-06

Generated

2026-10-19

AI Q&A

2026-10-05

EPSS Evaluated

2026-10-18

NVD

CVE-2026-59786

EUVD

EUVD-2026-92398

Affected Vendors & Products

Vendor	Product	Version / Range
Zabbix	Zabbix	7.0.0
Zabbix	Zabbix	7.4.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-940	The product establishes a communication channel to handle an incoming request that has been initiated by an actor, but it does not properly verify that the request is coming from the expected origin.

Attack-Flow Graph

Executive Summary

Zabbix Server and Proxy do not properly validate active agent heartbeat messages when PSK or certificate authentication is configured. This allows an attacker with access to the Zabbix trapper port to falsely report a host as available, compromising the integrity of the monitoring system.

Detection Guidance

This vulnerability allows unauthorized reporting of hosts as available via the Zabbix trapper port. To detect it, monitor the trapper port (default 10051) for unexpected active agent heartbeat messages. Check Zabbix server logs for unusual host registrations or heartbeat events from unknown sources. Use network monitoring tools like tcpdump to capture traffic on the trapper port and analyze for anomalies.

Impact Analysis

This vulnerability could lead to false availability reports, causing incorrect monitoring data. It may result in missed alerts for actual outages or false alarms, disrupting incident response and system reliability.

Compliance Impact

This vulnerability allows unauthorized reporting of hosts as available, which could lead to false data integrity in monitoring systems. This may impact compliance by compromising the accuracy of logs and records required for audits under standards like GDPR and HIPAA.

Mitigation Strategies

Ensure proper PSK or certificate authentication is enforced for active agent heartbeat messages. Restrict access to the Zabbix trapper port to trusted sources only.

Hi! I’m here to help you understand CVE-2026-59786. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70