# CVE-2026-59782: Zabbix Server and Proxy JavaScript preprocessing memory disclosure

Source: https://junglewise.ai/threats/cve-2026-59782-the-javascript-preprocessing-duktape-engine-on-zabbix-server-has  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-05. Updated: 2026-10-05  
License: CC BY 4.0 with a link back

CVE-2026-59782 · Severity: info · Published 2026-10-05

Zabbix Server and Proxy are monitoring platforms that allow administrators to define data collection and preprocessing rules. A limited administrator can exploit a vulnerability in the JavaScript preprocessing engine (Duktape) to read raw memory, potentially exposing sensitive data from other preprocessing operations they should not have access to. This could lead to unauthorized information disclosure if confidential monitoring data is processed by other administrators' rules.

Technologies: [Zabbix Proxy](https://junglewise.ai/threats/technologies/zabbix-proxy), [Zabbix Server](https://junglewise.ai/threats/technologies/zabbix-server). Vendors: [Zabbix](https://junglewise.ai/threats/vendors/zabbix).

## Quick answers

**Is CVE-2026-59782 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-59782 being exploited in the wild.

**How severe is CVE-2026-59782?** Informational severity, published 5 October 2026.

**Which products and versions are affected?** Zabbix Proxy 6.0.0-6.0.47, 7.0.0-7.0.28, 7.4.0-7.4.12; Zabbix Server 6.0.0-6.0.47, 7.0.0-7.0.28, 7.4.0-7.4.12.

**Is there a fix for CVE-2026-59782?** Yes: fixed in Server and Proxy: 6.0.48, 7.0.29, 7.4.13. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-59782 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-59782?** Check whether you run Zabbix Proxy or Zabbix Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Server and Proxy: 6.0.48, 7.0.29, 7.4.13

## Technical details

The Duktape JavaScript engine in Zabbix Server and Proxy fails to properly isolate memory access in preprocessing rules. An attacker with limited administrator privileges can craft malicious JavaScript preprocessing rules that read raw heap memory, bypassing access controls and exposing data from preprocessors not assigned to them. This is a local privilege escalation requiring existing administrative credentials.

## Affected products

- Zabbix Server 6.0.0-6.0.47, 7.0.0-7.0.28, 7.4.0-7.4.12
- Zabbix Proxy 6.0.0-6.0.47, 7.0.0-7.0.28, 7.4.0-7.4.12

## Timeline

- 2026-10-05: disclosed

## References

- [https://support.zabbix.com/browse/ZBX-28193](https://support.zabbix.com/browse/ZBX-28193)

## Related threats

- [Zabbix SNMP trap receiver record injection in zabbix_trap_receiver.pl](https://junglewise.ai/threats/cve-2026-59787-the-perl-snmp-trap-receiver-script-shipped-with-zabbix-does-not)
- [Zabbix Server and Proxy active agent heartbeat TLS bypass](https://junglewise.ai/threats/cve-2026-59786-zabbix-server-and-proxy-accept-the-active-agent-heartbeat-message)
- [Zabbix Server and Proxy denial of service via binary items](https://junglewise.ai/threats/cve-2026-59783-the-zabbix-server-proxy-has-a-vulnerability-where-binary-items)
- [Zabbix Server and Proxy denial of service via JavaScript preprocessing](https://junglewise.ai/threats/cve-2026-23938-zabbix-server-and-proxy-denial-of-service-via-javascript)
- [Zabbix Frontend session key disclosure in database](https://junglewise.ai/threats/cve-2026-23933-zabbix-frontend-session-key-disclosure-in-database)