Quick answers
- Is CVE-2026-59787 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-59787 being exploited in the wild.
- How severe is CVE-2026-59787?
- Informational severity, published 5 October 2026.
- Which products and versions are affected?
- Zabbix Proxy 6.0.0 - 6.0.47, 7.0.0 - 7.0.28, 7.4.0 - 7.4.12; Zabbix Server 6.0.0 - 6.0.47, 7.0.0 - 7.0.28, 7.4.0 - 7.4.12.
- Is there a fix for CVE-2026-59787?
- Yes: fixed in Server 6.0.48, 7.0.29, 7.4.13; Proxy 6.0.48, 7.0.29, 7.4.13. Until then: Update affected components and replace the deployed zabbix_trap_receiver.pl script with the fixed version from the updated release. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-59787 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-59787?
- Check whether you run Zabbix Proxy or Zabbix Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: Server 6.0.48, 7.0.29, 7.4.13; Proxy 6.0.48, 7.0.29, 7.4.13
Update affected components and replace the deployed zabbix_trap_receiver.pl script with the fixed version from the updated release.
Technical details
The Perl SNMP trap receiver script does not neutralize the ZBXTRAP record delimiter within trap payload content, enabling record injection attacks. An attacker with network access to send SNMP traps can craft payloads containing delimiter characters to inject fabricated records targeting arbitrary hosts, compromising data integrity. The vulnerability exists in Server and Proxy components across multiple Zabbix versions.
Affected products
- Zabbix Server 6.0.0 - 6.0.47, 7.0.0 - 7.0.28, 7.4.0 - 7.4.12
- Zabbix Proxy 6.0.0 - 6.0.47, 7.0.0 - 7.0.28, 7.4.0 - 7.4.12
Timeline
- 2026-10-05: disclosed