CVE-2026-23923: 
Zabbix Server vulnerability analysis and mitigation

CVE-2026-23923 is an unauthenticated arbitrary PHP class instantiation vulnerability in the Zabbix Frontend component, affecting versions 7.4.0 through 7.4.6. An unauthenticated attacker can exploit the Frontend 'validate' action to blindly instantiate arbitrary PHP classes without any authentication. The vulnerability was disclosed on March 24, 2026, and a fix was released in version 7.4.7. It carries a CVSS v4.0 base score of 6.9 (Medium) (Zabbix Bug Tracker, Red Hat Bugzilla).

The vulnerability is classified under CWE-470 (Use of Externally-Controlled Input to Select Classes or Code / 'Unsafe Reflection') and CWE-915 (Improperly Controlled Modification of Dynamically-Determined Object Attributes). The Zabbix Frontend's 'validate' action accepts user-supplied input that is used to select and instantiate PHP classes without adequate validation or sanitization, allowing any network-reachable user to trigger arbitrary class instantiation. No authentication, special privileges, or user interaction is required — the attack vector is purely network-based with low complexity. The concrete impact depends on which PHP classes are available in the environment and whether any have exploitable constructors or side effects (Zabbix Bug Tracker).

Successful exploitation can result in limited availability impact, as reflected in the CVSS v4.0 scoring (VA:L), with no direct confidentiality or integrity impact assessed at this time. However, the actual impact is environment-dependent: if classes with destructive constructors or side effects are available in the PHP environment, attackers could potentially trigger unintended code paths, cause service disruption, or achieve information disclosure. The attack requires no authentication and can be performed remotely by any user able to reach the Zabbix Frontend (Zabbix Bug Tracker, Red Hat Bugzilla).

1. Reconnaissance: Identify internet-facing or network-accessible Zabbix Frontend instances running versions 7.4.0 through 7.4.6 using tools like Shodan, Censys, or direct HTTP probing.
2. Target the 'validate' action: Send a crafted HTTP request (no authentication required) to the Zabbix Frontend endpoint that exposes the 'validate' action.
3. Supply a class name as input: Include a user-controlled parameter specifying the name of a PHP class to instantiate. The application uses this input directly in a reflection-based class instantiation call without adequate validation.
4. Trigger class instantiation: The server blindly instantiates the specified PHP class. Depending on the class selected and its constructor logic, this may cause unintended side effects such as resource exhaustion, file operations, or other environment-specific behaviors.
5. Assess impact: Evaluate the outcome based on the available PHP classes in the target environment to determine if further exploitation (e.g., denial of service, information leakage) is achievable (Zabbix Bug Tracker).

• Network: Unusual or repeated HTTP requests to the Zabbix Frontend 'validate' action endpoint from unauthenticated or unexpected source IPs.
• Logs: Zabbix Frontend access logs showing requests to the 'validate' action with unexpected or non-standard class name parameters; PHP error logs indicating failed or unexpected class instantiation attempts.
• Process: Unexpected PHP process behavior or resource spikes on the Zabbix Frontend server correlating with requests to the 'validate' endpoint.

Zabbix has released a fix in version 7.4.7, which addresses this vulnerability for all affected versions (7.4.0–7.4.6). The recommended remediation is to update the Zabbix Frontend to version 7.4.7 or later. As an interim measure, organizations should restrict network access to the Zabbix Frontend to trusted networks and authenticated users, and review access logs for suspicious activity targeting the 'validate' action. No specific workaround short of patching is documented (Zabbix Bug Tracker).