CVE-2026-59787: 
Zabbix Server vulnerability analysis and mitigation

CVE-2026-59787 is an SNMP trap injection vulnerability in the Perl SNMP trap receiver script (zabbix_trap_receiver.pl) shipped with Zabbix. The script fails to properly neutralize the ZBXTRAP record delimiter in trap content, allowing an attacker who can send SNMP traps to inject records targeting arbitrary hosts, resulting in a loss of monitoring data integrity. Affected versions include Zabbix 6.0.0–6.0.47, 7.0.0–7.0.28, and 7.4.0–7.4.12. The vulnerability was disclosed on October 5, 2026, and carries a CVSS v4.0 base score of 5.3 (Medium) (Zabbix Bug Tracker, GitHub Advisory).

The root cause is classified as CWE-143 (Improper Neutralization of Record Delimiters) and CWE-140 (Improper Neutralization of Delimiters). The zabbix_trap_receiver.pl Perl script uses the string ZBXTRAP as a record delimiter to separate trap entries when writing to a pipe consumed by the Zabbix server or proxy. Because the script does not sanitize or escape this delimiter within incoming trap content, a crafted SNMP trap payload containing the ZBXTRAP string can cause the receiver to interpret injected content as a new, separate trap record attributed to an arbitrary host. Exploitation requires network-level access to send SNMP traps to the receiver and low-level privileges (e.g., the ability to send UDP/162 packets), but no authentication against Zabbix itself (Zabbix Bug Tracker, GitHub Advisory).

Successful exploitation allows an attacker to inject falsified SNMP trap records into the Zabbix monitoring pipeline, attributing them to arbitrary monitored hosts. This compromises the integrity of monitoring data — operators may receive false alerts, miss genuine alerts, or be misled about the health of monitored infrastructure. There is no direct confidentiality or availability impact, and no evidence of lateral movement capability through this vulnerability alone (Zabbix Bug Tracker, GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS score is approximately 0.226% (12th percentile), indicating a low near-term exploitation probability. The vulnerability was reported to Zabbix via the HackerOne bug bounty platform by a researcher identified as "stoun" (Zabbix Bug Tracker).

1. Reconnaissance: Identify Zabbix deployments using SNMP trap monitoring (i.e., those running zabbix_trap_receiver.pl and listening on UDP port 162 or via snmptrapd).
2. Craft malicious SNMP trap: Construct an SNMP trap payload whose variable binding (varbind) value contains the literal string ZBXTRAP followed by a target host IP/name and injected trap content (e.g., ZBXTRAP <target-host-IP> <injected-trap-data>).
3. Send the trap: Transmit the crafted SNMP trap to the Zabbix server or proxy's SNMP trap receiver endpoint (typically UDP/162) using a tool such as snmptrap or snmpinform.
4. Trigger record injection: The zabbix_trap_receiver.pl script parses the incoming trap and, encountering the injected ZBXTRAP delimiter, splits the content into multiple records — one of which is attributed to the attacker-specified host.
5. Observe impact: The Zabbix server processes the injected record as a legitimate trap from the spoofed host, potentially triggering false alerts or suppressing legitimate ones (Zabbix Bug Tracker).

• Network: Unexpected SNMP trap traffic (UDP/162) from unknown or untrusted source IPs to the Zabbix server/proxy; SNMP trap payloads containing the string ZBXTRAP within varbind values.
• Logs: Zabbix trap log file (typically /tmp/zabbix_traps.tmp or configured trap file) containing multiple ZBXTRAP entries originating from a single received trap; entries attributing traps to hosts that did not send them.
• Zabbix UI: Unexpected or anomalous trap-based triggers firing for hosts that are not configured SNMP trap senders; duplicate or conflicting trap events for the same time window.

Zabbix has released fixed versions addressing this vulnerability: 6.0.48, 7.0.29, and 7.4.13. The recommended remediation is to update the affected Zabbix installation and replace the deployed zabbix_trap_receiver.pl with the fixed version from the patched release. As a network-level workaround, restrict SNMP trap access to trusted source IPs using firewall rules or network segmentation to limit which systems can send traps to the Zabbix receiver on UDP/162 (Zabbix Bug Tracker, GitHub Advisory).

The vulnerability was responsibly disclosed through Zabbix's HackerOne bug bounty program by researcher "stoun" and was acknowledged and fixed by the Zabbix team promptly on the same day as disclosure (October 5, 2026). Red Hat opened a tracking bug (Bugzilla #2545867) to assess impact on their packages. No significant broader media coverage or notable researcher commentary beyond the official advisory has been identified (Zabbix Bug Tracker, Red Hat Bugzilla).