CVE-2026-23938

Analyzed Analyzed - Analysis Complete

Denial of Service in Zabbix via Malicious JavaScript Preprocessing

Publication date: 2026-08-18

Last updated on: 2026-09-23

Assigner: Zabbix

Description

An authenticated administrator is able to crash Zabbix server or proxy by creating specifically crafted preprocessing/script item JavaScript scripts, leading to potential denial of service.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-18

Last Modified

2026-09-23

Generated

2026-09-28

AI Q&A

2026-08-18

EPSS Evaluated

2026-09-27

NVD

CVE-2026-23938

EUVD

EUVD-2026-60741

Affected Vendors & Products

Vendor	Product	Version / Range
zabbix	zabbix	From 6.0.0 (inc) to 6.0.47 (exc)
zabbix	zabbix	From 7.4.0 (inc) to 7.4.11 (exc)
zabbix	zabbix	From 7.0.0 (inc) to 7.0.27 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-248	An exception is thrown from a function, but it is not caught.

Attack-Flow Graph

Executive Summary

This vulnerability allows an authenticated administrator to crash the Zabbix server or proxy by creating specially crafted JavaScript preprocessing or script items. This can lead to a denial of service condition where the server or proxy becomes unavailable.

Detection Guidance

This vulnerability requires authenticated administrator access to exploit. Monitor Zabbix server logs for crashes or unusual JavaScript preprocessing/script item errors. Check for items with suspicious JavaScript code in the Zabbix frontend.

Impact Analysis

If exploited, this vulnerability could cause your Zabbix monitoring system to crash, disrupting visibility into your infrastructure and potentially leading to unmonitored outages or performance issues.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR or HIPAA by enabling a denial of service attack against Zabbix server or proxy, which may disrupt monitoring and logging systems critical for maintaining data integrity and availability under these regulations.

Mitigation Strategies

Apply the latest security patches from Zabbix to address the JavaScript preprocessing/script item vulnerability. Restrict administrative access to trusted users only and monitor for unusual script executions.

Hi! I’m here to help you understand CVE-2026-23938. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70