Quick answers
- Is CVE-2026-59785 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-59785 being exploited in the wild.
- How severe is CVE-2026-59785?
- Informational severity, published 5 October 2026.
- Which products and versions are affected?
- Zabbix 6.0.0–6.0.47, 7.0.0–7.0.28, 7.4.0–7.4.12.
- Is there a fix for CVE-2026-59785?
- Yes: fixed in 6.0.48, 7.0.29, 7.4.13. Until then: Update to the fixed versions: 6.0.48, 7.0.29, or 7.4.13 depending on your deployed version. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-59785 attacked?
- It is attacked from the adjacent network, in a web application.
- Am I affected by CVE-2026-59785?
- Check whether you run Zabbix at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: 6.0.48, 7.0.29, 7.4.13
Update to the fixed versions: 6.0.48, 7.0.29, or 7.4.13 depending on your deployed version.
Technical details
The vulnerability exists in the Zabbix Frontend's multiselect.get filtering functionality, which allows search queries on host credential fields that are not displayed in the user interface (IPMI and PSK). An authenticated user with host read privileges can craft search queries to filter by these hidden fields; if a guess matches, the search result indicates the match, enabling credential enumeration through repeated guessing. This is an information disclosure vulnerability affecting the API-level host search implementation.
Affected products
- Zabbix Zabbix 6.0.0–6.0.47, 7.0.0–7.0.28, 7.4.0–7.4.12
Timeline
- 2026-10-05: disclosed: Advisory published