CVE-2026-23930
Received Received - Intake

Frontend Webserver CPU Exhaustion via Malicious Popup Requests

Publication date: 2026-08-18

Last updated on: 2026-08-18

Assigner: Zabbix

Description
An unauthenticated user is able to cause disproportionate CPU load on the Frontend webserver by sending specifically crafted requests to the Frontend popup.testtriggerexpr action, leading to potential denial of service.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-18
Last Modified
2026-08-18
Generated
2026-08-18
AI Q&A
2026-08-18
EPSS Evaluated
N/A
NVD
CVE-2026-23930
EUVD
EUVD-2026-60735

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
zabbix zabbix *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-405 The product does not properly control situations in which an adversary can cause the product to consume or produce excessive resources without requiring the adversary to invest equivalent work or otherwise prove authorization, i.e., the adversary's influence is "asymmetric."

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability allows an unauthenticated user to send specially crafted requests to the Frontend popup.testtriggerexpr action, causing excessive CPU usage on the webserver. This can lead to a denial of service by overwhelming system resources.

Detection Guidance

Monitor CPU usage spikes on the Frontend webserver, particularly when accessing the popup.testtriggerexpr action. Check web server logs for repeated requests to this endpoint from the same or multiple sources.

Impact Analysis

The impact includes degraded performance or complete unavailability of the webserver due to high CPU load. This can disrupt services relying on the Frontend component, affecting user access and functionality.

Compliance Impact

This vulnerability could lead to denial of service by causing disproportionate CPU load, which may impact availability of systems handling sensitive data. Compliance with GDPR and HIPAA requires maintaining system availability and protecting personal health information, so such disruptions could pose risks to compliance.

Mitigation Strategies

Restrict access to the popup.testtriggerexpr action endpoint. Implement rate limiting on the webserver to prevent excessive requests. Update Zabbix to the latest patched version if available.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-23930. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart