CVE-2026-23920: 
Zabbix Server vulnerability analysis and mitigation

CVE-2026-23920 is an OS command injection vulnerability in Zabbix affecting host and event action script input validation. The flaw arises because the administrator-configured regex validation runs in multiline mode, allowing authenticated users to inject a newline character to bypass ^ and $ anchor checks and execute arbitrary shell commands. Affected versions include Zabbix 7.0.0–7.0.21, 7.2.0–7.2.14, and 7.4.0–7.4.5. It was disclosed on March 24, 2026, and carries a CVSS v4.0 base score of 7.7 (High) (Zabbix Issue Tracker, Red Hat Advisory).

The root cause is improper neutralization of special elements used in an OS command (CWE-78), specifically a regex validation bypass via newline injection. Zabbix validates host and event action script inputs using an administrator-defined regular expression, but this validation is applied in multiline mode. When ^ and $ anchors are used, they match the start and end of individual lines rather than the entire string, so an attacker can append a newline followed by a malicious shell command to bypass the validation check entirely. The attack requires network access, low privileges (authenticated user with script execution permissions), low complexity, and no user interaction, but does require the presence of ^/$ anchors in the configured validation regex (Zabbix Issue Tracker, Red Hat Bugzilla).

Successful exploitation allows authenticated attackers to inject and execute arbitrary shell commands through Zabbix host and event action scripts, potentially resulting in full system compromise. This includes unauthorized access to sensitive data, unauthorized system modification, and potential lateral movement within the monitored infrastructure. Both the Zabbix Server and Proxy components are affected (Zabbix Issue Tracker, Red Hat Advisory).

1. Reconnaissance: Identify Zabbix instances running affected versions (7.0.0–7.0.21, 7.2.0–7.2.14, or 7.4.0–7.4.5) with externally accessible web interfaces.
2. Authentication: Log in to the Zabbix frontend with a valid account that has permissions to configure or execute host/event action scripts.
3. Identify validation regex: Determine whether the administrator has configured input validation using ^ and $ anchors for script parameters (e.g., via the Zabbix administration panel under Action scripts).
4. Craft malicious input: Construct a payload that satisfies the regex on the first line, then appends a newline character (\n) followed by the desired shell command (e.g., validinput\nmalicious_command).
5. Submit payload: Enter the crafted input into the script parameter field. Because the regex runs in multiline mode, ^ and $ match only the first line, allowing the injected command on the second line to pass validation.
6. Achieve code execution: Trigger the action script execution; the injected shell command runs on the Zabbix Server or Proxy host with the privileges of the Zabbix service account (Zabbix Issue Tracker, Red Hat Bugzilla).

• Logs: Zabbix server or proxy logs showing unexpected shell commands executed as part of action scripts; audit logs recording unusual script parameter values containing newline characters (\n or %0a).
• Process: Unexpected child processes spawned by the Zabbix server or proxy process (e.g., /bin/sh, bash, curl, wget, python) with unusual arguments.
• Network: Outbound connections from the Zabbix server or proxy to unknown external IP addresses or domains, particularly following action script execution events.
• File System: New or modified files in directories writable by the Zabbix service account; presence of web shells, reverse shell scripts, or unauthorized cron jobs created under the Zabbix user context.

Zabbix has released fixed versions addressing this vulnerability: 7.0.22, 7.2.15, and 7.4.6. Organizations should upgrade affected installations immediately. As a temporary workaround without upgrading, administrators can replace ^ and $ anchors in their input validation regexes with \A and \z anchors, which are not affected by multiline mode and enforce true start-of-string and end-of-string matching. Additionally, restricting script execution permissions to only trusted, necessary accounts reduces the attack surface (Zabbix Issue Tracker, Red Hat Advisory).

The vulnerability was acknowledged by Zabbix and credited to YoKo Kho (@YoKoAcc) from PT ITSEC Asia, Tbk via the HackerOne bug bounty program. Red Hat tracked the issue in their security advisory system and Bugzilla. No significant broader media coverage or notable researcher commentary beyond the official disclosure has been identified at this time (Zabbix Issue Tracker, Red Hat Advisory).