CVE-2026-59786: 
Zabbix Server vulnerability analysis and mitigation

CVE-2026-59786 is an authentication bypass vulnerability in Zabbix Server and Proxy, described as "Active agent heartbeat missing TLS check." The flaw allows unauthenticated attackers with access to the Zabbix trapper port to send crafted heartbeat messages that report arbitrary hosts as available, bypassing configured PSK or certificate authentication and resulting in a loss of integrity. Affected versions are Zabbix 7.0.0 through 7.0.28 and 7.4.0 through 7.4.12. It was disclosed on October 5, 2026, and carries a CVSS v4.0 base score of 6.9 (Medium) (Zabbix Bug Tracker, GitHub Advisory).

The root cause is classified under CWE-940 (Improper Verification of Source of a Communication Channel) and CWE-306 (Missing Authentication for Critical Function): the Zabbix trapper port processes active agent heartbeat messages without verifying that the sender has completed the configured TLS/PSK or certificate authentication handshake (Zabbix Bug Tracker, GitHub Advisory). An attacker with network-level access to the trapper port (default TCP 10051) can craft and send a heartbeat packet specifying an arbitrary hostname, causing the server or proxy to mark that host as active/available without any credential validation. No special privileges or user interaction are required, and the attack complexity is low (GitHub Advisory). The vulnerability was reported by Aditya Bisht via the HackerOne bug bounty program (Zabbix Bug Tracker).

Successful exploitation allows an unauthenticated attacker to manipulate the monitoring status of arbitrary hosts within Zabbix, causing the server or proxy to falsely report those hosts as available. This constitutes a loss of integrity in monitoring data, which could mask genuine outages, suppress alerts, or mislead operators into believing monitored systems are healthy when they are not. There is no direct confidentiality or availability impact to the Zabbix server itself, and no evidence of lateral movement capability through this vulnerability alone (Zabbix Bug Tracker, GitHub Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been observed as of the time of disclosure (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.203% (9th percentile), indicating a low near-term exploitation probability. The attack is automatable due to its network-accessible, unauthenticated nature, but the impact is limited to integrity manipulation of monitoring data (GitHub Advisory, Red Hat Bugzilla).

1. Reconnaissance: Identify Zabbix Server or Proxy instances running versions 7.0.0–7.0.28 or 7.4.0–7.4.12 with the trapper port (default TCP 10051) exposed to the network, using tools such as Shodan, Censys, or nmap.
2. Access the trapper port: Establish a TCP connection to the Zabbix trapper port (default 10051) on the target server or proxy — no TLS handshake or credential exchange is required.
3. Craft a heartbeat message: Construct a Zabbix active agent heartbeat protocol message specifying an arbitrary target hostname (e.g., a host already registered in Zabbix or a spoofed host name).
4. Send the unauthenticated heartbeat: Transmit the crafted packet to the trapper port. Because the server/proxy does not verify the sender's authentication credentials for heartbeat messages, it accepts the message.
5. Observe impact: The targeted host is marked as "available" in the Zabbix monitoring dashboard, regardless of its actual state, manipulating monitoring integrity and potentially suppressing alerts (Zabbix Bug Tracker, GitHub Advisory).

• Network: Unexpected or anomalous TCP connections to the Zabbix trapper port (default 10051) from IP addresses not corresponding to known Zabbix agents or proxies; high-frequency heartbeat packets from a single source.
• Logs: Zabbix server or proxy logs showing heartbeat messages accepted from unrecognized or unexpected source IPs; hosts being marked as "available" without corresponding legitimate agent activity.
• Monitoring Data: Hosts appearing as active/available in the Zabbix dashboard that are known to be offline or unreachable; discrepancies between Zabbix host status and actual host availability confirmed by other monitoring tools.

Zabbix has released fixed versions: 7.0.29 (for the 7.0.x branch) and 7.4.13 (for the 7.4.x branch); upgrading to these versions is the recommended remediation (Zabbix Bug Tracker). As a workaround prior to patching, restrict network access to the Zabbix trapper port (TCP 10051) using firewall rules or network segmentation, allowing only trusted agent and proxy IP addresses to connect. No additional configuration-based workarounds are documented by the vendor (Zabbix Bug Tracker).

The vulnerability was reported through Zabbix's HackerOne bug bounty program by researcher Aditya Bisht, and Zabbix acknowledged and credited the researcher in their official bug tracker entry (Zabbix Bug Tracker). Red Hat has tracked the issue in their Bugzilla as a medium-severity security response item (Red Hat Bugzilla). No significant broader community or social media discussion has been identified beyond standard CVE aggregator coverage.