Vulnerability in Zabbix

[ Description ]Official description

Host search in Frontend allows filtering by fields that are not displayed, including stored IPMI and PSK credentials. A user with read access can guess a credential and see from the search result whether the guess was right, letting them uncover it.

[ Fixes ]Fixes and patches

• Security bulletin: Zabbix ZBX-28194Vendor patch or bulletin · CERT-FR · support.zabbix.com/browse/ZBX-28194, cited by CERT-FR CERTFR-2026-AVI-1261
• Security bulletin: Zabbix ZBX-28195Vendor patch or bulletin · CERT-FR · support.zabbix.com/browse/ZBX-28195, cited by CERT-FR CERTFR-2026-AVI-1261
• Security bulletin: Zabbix ZBX-28197Vendor patch or bulletin · CERT-FR · support.zabbix.com/browse/ZBX-28197, cited by CERT-FR CERTFR-2026-AVI-1261
• Security bulletin: Zabbix ZBX-28198Vendor patch or bulletin · CERT-FR · support.zabbix.com/browse/ZBX-28198, cited by CERT-FR CERTFR-2026-AVI-1261
• Security bulletin: Zabbix ZBX-28193Vendor patch or bulletin · CERT-FR · support.zabbix.com/browse/ZBX-28193, cited by CERT-FR CERTFR-2026-AVI-1261
• Security bulletin: Zabbix ZBX-28196Vendor patch or bulletin · CERT-FR · support.zabbix.com/browse/ZBX-28196, cited by CERT-FR CERTFR-2026-AVI-1261

[ Advisories ]Government CERT advisories

• CERT-FR5 Oct 2026CERTFR-2026-AVI-1261

  Multiple vulnerabilities in Zabbix Translated from French

  Multiple vulnerabilities have been discovered in Zabbix. Some of them allow an attacker to cause remote denial of service, a breach of data confidentiality and a breach of data integrity.

  CVE-2026-59785CVE-2026-59786CVE-2026-59782+3 more CVEs
• BSI CERT-Bund4 Oct 2026WID-SEC-2026-3724

  Zabbix: Multiple vulnerabilities Translated from German

  CVE-2026-59783CVE-2026-59782CVE-2026-59787+2 more CVEs

[ References ]References

• support.zabbix.com/browse/ZBX-28195