CVE-2025-27237: 
Zabbix Server vulnerability analysis and mitigation

CVE-2025-27237 is a security vulnerability discovered in Zabbix Agent and Agent 2 on Windows systems. The vulnerability was disclosed on October 3, 2025, and involves the OpenSSL configuration file being loaded from a path that is writable by low-privileged users (NVD, Zabbix Support).

The vulnerability has been assigned a CVSS v4.0 base score of 7.3 (High) with the vector string CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. The weakness is categorized as CWE-427 (Uncontrolled Search Path Element). The vulnerability affects multiple versions of Zabbix Agent and Agent 2, specifically versions 6.0.0-6.0.40, 7.0.0-7.0.17, 7.2.0-7.2.11, and 7.4.0-7.4.1 (Zabbix Support).

The vulnerability allows malicious modification of the OpenSSL configuration file and potential local privilege escalation through DLL injection. The impact is considered high as it affects the confidentiality, integrity, and availability of the system (Zabbix Support).

The vulnerability has been fixed in Zabbix Agent and Agent 2 versions 6.0.41, 7.0.18, 7.2.12, and 7.4.2. Users are advised to update their installations to these fixed versions to mitigate the vulnerability (Zabbix Support).

The vulnerability was responsibly disclosed through the HackerOne bug bounty platform by a researcher known as 'himbeer'. Zabbix has acknowledged and addressed the vulnerability through their security advisory (Zabbix Support).