Vulnerability in Zabbix

[ Description ]Official description

The JavaScript preprocessing (Duktape) engine on Zabbix server has a vulnerability where a limited administrator is able to read raw heap data potentially resulting in leaked data from other running preprocessors not available to said administrator.

[ Fixes ]Fixes and patches

• Security bulletin: Zabbix ZBX-28194Vendor patch or bulletin · CERT-FR · support.zabbix.com/browse/ZBX-28194, cited by CERT-FR CERTFR-2026-AVI-1261
• Security bulletin: Zabbix ZBX-28195Vendor patch or bulletin · CERT-FR · support.zabbix.com/browse/ZBX-28195, cited by CERT-FR CERTFR-2026-AVI-1261
• Security bulletin: Zabbix ZBX-28197Vendor patch or bulletin · CERT-FR · support.zabbix.com/browse/ZBX-28197, cited by CERT-FR CERTFR-2026-AVI-1261
• Security bulletin: Zabbix ZBX-28198Vendor patch or bulletin · CERT-FR · support.zabbix.com/browse/ZBX-28198, cited by CERT-FR CERTFR-2026-AVI-1261
• Security bulletin: Zabbix ZBX-28193Vendor patch or bulletin · CERT-FR · support.zabbix.com/browse/ZBX-28193, cited by CERT-FR CERTFR-2026-AVI-1261
• Security bulletin: Zabbix ZBX-28196Vendor patch or bulletin · CERT-FR · support.zabbix.com/browse/ZBX-28196, cited by CERT-FR CERTFR-2026-AVI-1261

[ Advisories ]Government CERT advisories

• CERT-FR5 Oct 2026CERTFR-2026-AVI-1261

  Multiple vulnerabilities in Zabbix Translated from French

  Multiple vulnerabilities have been discovered in Zabbix. Some of them allow an attacker to cause remote denial of service, a breach of data confidentiality and a breach of data integrity.

  CVE-2026-59785CVE-2026-59786CVE-2026-59782+3 more CVEs
• BSI CERT-Bund4 Oct 2026WID-SEC-2026-3724

  Zabbix: Multiple vulnerabilities Translated from German

  CVE-2026-59783CVE-2026-59782CVE-2026-59787+2 more CVEs

[ References ]References

• support.zabbix.com/browse/ZBX-28193