Quick answers
- Is CVE-2026-23938 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-23938 being exploited in the wild.
- How severe is CVE-2026-23938?
- Medium severity, with a CVSS score of 4.9, published 18 August 2026.
- Which products and versions are affected?
- Zabbix Proxy 6.0.0–6.0.46, 7.0.0–7.0.26, 7.4.0–7.4.10; Zabbix Server 6.0.0–6.0.46, 7.0.0–7.0.26, 7.4.0–7.4.10.
- Is there a fix for CVE-2026-23938?
- A patch was published on 2026-08-18: Fixes released: 6.0.47, 7.0.27, 7.4.11 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-23938 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-23938?
- Check whether you run Zabbix Proxy or Zabbix Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
This vulnerability is a denial-of-service condition in Zabbix Server and Proxy triggered by improper handling of specifically crafted JavaScript code in preprocessing and script item configurations. The vulnerability affects the JavaScript execution engine when processing administrator-supplied preprocessing or script payloads, allowing a crash of the server or proxy process. An authenticated administrator account (non-super admin with sufficient privileges) is required to exploit this vulnerability, and successful exploitation results in temporary unavailability of the monitoring infrastructure. Patches are available for all affected branches: 6.0.47, 7.0.27, and 7.4.11.
Affected products
- Zabbix Zabbix Server 6.0.0–6.0.46, 7.0.0–7.0.26, 7.4.0–7.4.10
- Zabbix Zabbix Proxy 6.0.0–6.0.46, 7.0.0–7.0.26, 7.4.0–7.4.10
Timeline
- 2026-08-18: disclosed: Vulnerability published
- 2026-08-18: patched: Fixes released: 6.0.47, 7.0.27, 7.4.11