Changeflow GovPing Data Privacy & Cybersecurity Multiple Zabbix Vulnerabilities Disclosed
Priority review Notice Added Final

Multiple Zabbix Vulnerabilities Disclosed

Favicon for www.cert.ssi.gouv.fr CERT-FR Security Advisories
Published March 25th, 2026
Detected March 25th, 2026
Email

Summary

CERT-FR has issued an advisory regarding multiple vulnerabilities discovered in Zabbix software. These vulnerabilities could allow remote code execution, data breaches, and SQL injection. Affected versions include specific releases of Zabbix 6.0, 7.0, 7.2, and 7.4.

View original document View source feed page

What changed

CERT-FR, the French national cybersecurity agency, has published an advisory detailing multiple critical vulnerabilities found in Zabbix monitoring software. The vulnerabilities, identified by CVE numbers such as CVE-2026-23919 through CVE-2026-23924, can lead to remote code execution, data confidentiality breaches, and SQL injection attacks. The advisory specifically lists affected versions of Zabbix, including 6.0.x prior to 6.0.44, 7.0.x prior to 7.0.23, 7.2.x prior to 7.2.15, and 7.4.x prior to 7.4.7.

Organizations utilizing the affected Zabbix versions are strongly advised to consult the Zabbix security bulletins and apply the necessary patches immediately to mitigate the risks of exploitation. Failure to do so could result in significant data breaches, system compromise, and unauthorized access. The advisory directs users to the vendor's security bulletins for specific patch information and remediation steps.

What to do next

  1. Review Zabbix security bulletins (ZBX-27638 to ZBX-27642) for specific patch details.
  2. Apply available patches to Zabbix versions 6.0.x, 7.0.x, 7.2.x, and 7.4.x to address identified vulnerabilities.
  3. Assess systems for any signs of compromise related to these vulnerabilities.

Source document (simplified)

Premier Ministre S.G.D.S.N

Agence nationale
de la sécurité des
systèmes d'information

Paris, le 25 mars 2026 N° CERTFR-2026-AVI-0353 Affaire suivie par: CERT-FR

Avis du CERT-FR

Objet: Multiples vulnérabilités dans Zabbix

Gestion du document

| Référence | CERTFR-2026-AVI-0353 |
| Titre | Multiples vulnérabilités dans Zabbix |
| Date de la première version | 25 mars 2026 |
| Date de la dernière version | 25 mars 2026 |
| Source(s) | Bulletin de sécurité Zabbix ZBX-27638 du 24 mars 2026
Bulletin de sécurité Zabbix ZBX-27639 du 24 mars 2026
Bulletin de sécurité Zabbix ZBX-27640 du 24 mars 2026
Bulletin de sécurité Zabbix ZBX-27641 du 24 mars 2026
Bulletin de sécurité Zabbix ZBX-27642 du 24 mars 2026 |
Une gestion de version détaillée se trouve à la fin de ce document.

Risques

  • Atteinte à la confidentialité des données
  • Contournement de la politique de sécurité
  • Exécution de code arbitraire à distance
  • Injection SQL (SQLi)

Systèmes affectés

  • Zabbix versions 6.0.x antérieures à 6.0.44
  • Zabbix versions 7.0.x antérieures à 7.0.23
  • Zabbix versions 7.2.x antérieures à 7.2.15
  • Zabbix versions 7.4.x antérieures à 7.4.7

Résumé

De multiples vulnérabilités ont été découvertes dans Zabbix. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une atteinte à la confidentialité des données et une injection SQL (SQLi).

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Documentation

Gestion détaillée du document

  1. le 25 mars 2026 Version initiale

Named provisions

Risks Affected Systems Summary Solutions Documentation

Related changes

Favicon for www.cert.ssi.gouv.fr Tenable OT Platform Vulnerability Allows Data Confidentiality Breach
Priority review Mar 25, 2026 • CERT-FR Security Advisories • Data Privacy & Cybersecurity
Favicon for www.cert.ssi.gouv.fr Multiple vulnerabilities found in F5 products
Priority review Mar 25, 2026 • CERT-FR Security Advisories • Data Privacy & Cybersecurity
Favicon for www.cert.ssi.gouv.fr Multiple Squid Vulnerabilities Affect Data Confidentiality and Availability
Priority review Mar 25, 2026 • CERT-FR Security Advisories • Data Privacy & Cybersecurity
Favicon for www.cisa.gov CISA Adds CVE-2026-33017 to Known Exploited Vulnerabilities Catalog
Priority review Mar 25, 2026 • CISA ICS-CERT Advisories • Data Privacy & Cybersecurity
Favicon for oig.hhs.gov HHS FISMA Compliance Report: Not Effective, 10 Recommendations Made
Priority review Mar 25, 2026 • HHS OIG Reports & Publications • Healthcare
Favicon for changeflow.com EPO Patent EP3286707A1: Authentication Server for Electronic Devices
Routine Mar 25, 2026 • ChangeBridge: EPO Bulletin - Business Methods (G06Q) • Banking & Finance

Source

Favicon for www.cert.ssi.gouv.fr
CERT-FR Security Advisories cert.ssi.gouv.fr/avis
Data Privacy & Cybersecurity
Analysis generated by AI. Source diff and links are from the original.

Classification

Agency
CERT-FR
Published
March 25th, 2026
Instrument
Notice
Legal weight
Non-binding
Stage
Final
Change scope
Substantive
Document ID
CERTFR-2026-AVI-0353

Who this affects

Applies to
Technology companies
Industry sector
5112 Software & Technology
Activity scope
Vulnerability Management System Monitoring
Geographic scope
France FR

Taxonomy

Primary area
Cybersecurity
Operational domain
IT Security
Compliance frameworks
NIST CSF
Topics
Vulnerability Management Information Security

Browse Categories

Agriculture & Food Safety 61 AI Regulation 3 Banking & Finance 238 Consumer Protection 41 Courts & Legal 323 Data Privacy & Cybersecurity 64 Defense & National Security 48 Education 20 Energy 105 Environment 83 Government & Legislation 264 Healthcare 131 Housing 16 Immigration 9 Insurance 56 Labor & Employment 111 Legal & Courts 1 Pharma & Drug Safety 99 Securities & Markets 80 Tax 64 Telecom & Technology 48 Trade & Sanctions 124 Transportation 56

Get Data Privacy & Cybersecurity alerts

Weekly digest. AI-summarized, no noise.

Free. Unsubscribe anytime.

Get alerts for this source

We'll email you when CERT-FR Security Advisories publishes new changes.

Free. Unsubscribe anytime.