Quick answers
- Is CVE-2026-23931 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-23931 being exploited in the wild.
- How severe is CVE-2026-23931?
- Medium severity, with a CVSS score of 4.3, published 18 August 2026.
- Which products and versions are affected?
- Zabbix Frontend 7.4.0 to 7.4.10.
- Is there a fix for CVE-2026-23931?
- A patch was published on 2026-08-18: Fix released in version 7.4.11 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-23931 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-23931?
- Check whether you run Zabbix or Zabbix Frontend at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is an information disclosure flaw in the Zabbix Frontend's validatate.api.exists API action. Authenticated users can exploit this by sending crafted HTTP requests to enumerate and extract plaintext values of user macros. The attack requires valid authentication credentials but no additional user interaction. Macro values configured with 'Secret text' or 'Vault secret' types are protected and not vulnerable. The vulnerability affects versions 7.4.0 through 7.4.10, with a fix available in version 7.4.11 and later.
Affected products
- Zabbix Zabbix Frontend 7.4.0 to 7.4.10
Timeline
- 2026-08-18: disclosed
- 2026-08-18: patched: Fix released in version 7.4.11