Quick answers
- Is CVE-2026-59786 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-59786 being exploited in the wild.
- How severe is CVE-2026-59786?
- Informational severity, published 5 October 2026.
- Which products and versions are affected?
- Zabbix Proxy 7.0.0 to 7.0.28, 7.4.0 to 7.4.12; Zabbix Server 7.0.0 to 7.0.28, 7.4.0 to 7.4.12.
- Is there a fix for CVE-2026-59786?
- Yes: fixed in Server and Proxy 7.0.29, 7.4.13. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-59786 attacked?
- It is attacked over the network, in a hosted service.
- Am I affected by CVE-2026-59786?
- Check whether you run Zabbix Proxy or Zabbix Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: Server and Proxy 7.0.29, 7.4.13
Technical details
The active agent heartbeat message handler in Zabbix Server and Proxy fails to enforce TLS authentication (PSK or certificate verification) before accepting heartbeat packets, allowing unauthenticated message injection. An attacker with network access to the trapper port can craft heartbeat messages to report arbitrary monitored hosts as available, resulting in loss of integrity of monitoring data. Patches are available in versions 7.0.29 and 7.4.13.
Affected products
- Zabbix Server 7.0.0 to 7.0.28, 7.4.0 to 7.4.12
- Zabbix Proxy 7.0.0 to 7.0.28, 7.4.0 to 7.4.12
Timeline
- 2026-10-05: disclosed