Zabbix Vulnerabilities Allow Remote Attacks

CERT-Bund has released a security advisory (WID-SEC-2026-0857) concerning critical vulnerabilities in Zabbix, a popular open-source network monitoring system. The advisory highlights multiple flaws, collectively rated with a high CVSS base score of 8.8, that can be exploited by attackers from an adjacent network. Successful exploitation could lead to information disclosure, shell command injection, SQL injection, and denial of service attacks. The affected versions include Zabbix versions prior to 7.4.3, 7.0.19, 7.2.13, 6.0.41, and several other specific patch levels across these major releases.

Organizations utilizing Zabbix should immediately review their deployed versions against the advisory's list of affected products. Mitigation strategies are available, and it is strongly recommended to update to the patched versions as soon as possible to prevent exploitation. Failure to address these vulnerabilities could result in significant security breaches, including unauthorized system access and data compromise. The advisory indicates that remote attacks are possible, emphasizing the urgency of patching.