CVE-2026-23921: 
Zabbix Server vulnerability analysis and mitigation

CVE-2026-23921 is a blind SQL injection vulnerability in the Zabbix API, specifically within include/classes/api/CApiService.php, exploitable via the sortfield parameter. A low-privilege Zabbix user with API access can leverage this flaw to execute arbitrary SQL SELECT queries using time-based techniques, potentially leading to session identifier disclosure and administrator account compromise. Affected versions include Zabbix 7.0.0–7.0.21, 7.2.0–7.2.14, and 7.4.0–7.4.5. The vulnerability was disclosed on March 24, 2026, and carries a CVSS v4.0 base score of 8.7 (High) (Zabbix Advisory, Red Hat Bugzilla).

The root cause is improper neutralization of special elements in SQL commands (CWE-89), located in the CApiService.php file that handles Zabbix API requests. The sortfield parameter is not adequately sanitized before being incorporated into database queries, allowing an attacker to inject arbitrary SQL syntax. Because query results are not returned directly to the API response, exploitation relies on time-based blind SQL injection techniques (e.g., using conditional delays) to infer data values character by character. Exploitation requires only a valid low-privilege Zabbix account with API access — no additional configuration or elevated permissions are needed (Zabbix Advisory, Red Hat Bugzilla).

Successful exploitation allows an attacker to exfiltrate arbitrary data from the Zabbix database, including session identifiers and administrator credentials, through time-based inference. This can lead to full compromise of the Zabbix administrative account, enabling an attacker to reconfigure monitoring infrastructure, access monitored host credentials, or pivot to other systems managed by Zabbix. The vulnerability affects confidentiality, integrity, and availability at the vulnerable component level (all rated High in CVSS v4.0) (Zabbix Advisory, Red Hat Bugzilla).

1. Reconnaissance: Identify Zabbix instances running affected versions (7.0.0–7.0.21, 7.2.0–7.2.14, or 7.4.0–7.4.5) with the API endpoint exposed, using tools like Shodan or direct version enumeration via the Zabbix API apiinfo.version method.
2. Obtain low-privilege credentials: Acquire or register a low-privilege Zabbix user account that has API access enabled.
3. Authenticate to the API: Send a POST request to the Zabbix API endpoint (e.g., /api_jsonrpc.php) using the user.login method to obtain a valid session token.
4. Craft malicious sortfield payload: Construct an API request to a method that accepts the sortfield parameter (e.g., host.get, item.get) and inject a time-based SQL payload such as IF(1=1, SLEEP(5), 0) into the sortfield value.
5. Exfiltrate data via timing: Iteratively send crafted requests with conditional SQL expressions that cause measurable response delays when a condition is true, allowing character-by-character extraction of sensitive data (e.g., session tokens, password hashes) from the database.
6. Escalate access: Use extracted administrator session tokens or credentials to authenticate as an administrator and take full control of the Zabbix instance (Zabbix Advisory).

• Network: Unusual or repeated API POST requests to /api_jsonrpc.php with sortfield parameters containing SQL keywords (e.g., SLEEP, IF, BENCHMARK, WAITFOR DELAY) or encoded equivalents.
• Logs: Zabbix API access logs showing high-latency responses to API calls from a single low-privilege user account; repeated calls to methods like host.get or item.get with anomalous sortfield values.
• Database: Database slow query logs showing repeated time-delay functions (e.g., SLEEP(), BENCHMARK()) originating from the Zabbix application database user.
• Behavioral: A low-privilege user account making an unusually high volume of API requests in a short period, particularly to data-retrieval methods with sorting parameters (Zabbix Advisory).

Zabbix has released fixed versions addressing this vulnerability: 7.0.22, 7.2.15, and 7.4.6. Organizations should upgrade to the respective fixed version as the primary remediation (Zabbix Advisory). No official workarounds are provided by the vendor. As interim mitigations, administrators should restrict API access to trusted users only, implement network-level controls (firewall rules, VPN) to limit exposure of the API endpoint, deploy WAF rules to detect SQL injection patterns in API parameters, and audit all accounts with API access privileges.

The vulnerability was reported through HackerOne's bug bounty program by a researcher identified as "SeaWind" and was acknowledged by Zabbix (Zabbix Advisory). Red Hat tracked the issue via Bugzilla and assessed it as high severity for their product ecosystem (Red Hat Bugzilla). The vulnerability was included in weekly threat landscape digests by security monitoring services, indicating moderate community awareness (Hawk-Eye Digest). No significant broader media coverage or notable researcher commentary beyond standard vulnerability tracking has been observed.