Vulnerability in Zabbix

[ Description ]Official description

Zabbix Server and Proxy accept the active agent heartbeat message regardless of the configured PSK or certificate authentication. This means someone with access to the Zabbix trapper port can report an arbitrary host using an active agent as available, resulting in a loss of integrity.

[ Fixes ]Fixes and patches

• Security bulletin: Zabbix ZBX-28194Vendor patch or bulletin · CERT-FR · support.zabbix.com/browse/ZBX-28194, cited by CERT-FR CERTFR-2026-AVI-1261
• Security bulletin: Zabbix ZBX-28195Vendor patch or bulletin · CERT-FR · support.zabbix.com/browse/ZBX-28195, cited by CERT-FR CERTFR-2026-AVI-1261
• Security bulletin: Zabbix ZBX-28197Vendor patch or bulletin · CERT-FR · support.zabbix.com/browse/ZBX-28197, cited by CERT-FR CERTFR-2026-AVI-1261
• Security bulletin: Zabbix ZBX-28198Vendor patch or bulletin · CERT-FR · support.zabbix.com/browse/ZBX-28198, cited by CERT-FR CERTFR-2026-AVI-1261
• Security bulletin: Zabbix ZBX-28193Vendor patch or bulletin · CERT-FR · support.zabbix.com/browse/ZBX-28193, cited by CERT-FR CERTFR-2026-AVI-1261
• Security bulletin: Zabbix ZBX-28196Vendor patch or bulletin · CERT-FR · support.zabbix.com/browse/ZBX-28196, cited by CERT-FR CERTFR-2026-AVI-1261

[ Advisories ]Government CERT advisories

• CERT-FR5 Oct 2026CERTFR-2026-AVI-1261

  Multiple vulnerabilities in Zabbix Translated from French

  Multiple vulnerabilities have been discovered in Zabbix. Some of them allow an attacker to cause remote denial of service, a breach of data confidentiality and a breach of data integrity.

  CVE-2026-59785CVE-2026-59786CVE-2026-59782+3 more CVEs
• BSI CERT-Bund4 Oct 2026WID-SEC-2026-3724

  Zabbix: Multiple vulnerabilities Translated from German

  CVE-2026-59783CVE-2026-59782CVE-2026-59787+2 more CVEs

[ References ]References

• support.zabbix.com/browse/ZBX-28196