Vulnerability in Zabbix

[ Description ]Official description

The Perl SNMP trap receiver script shipped with Zabbix does not properly neutralize the ZBXTRAP record delimiter in trap content. This means someone able to send SNMP traps can inject a record targeting another host, resulting in a loss of integrity.

[ Fixes ]Fixes and patches

• Security bulletin: Zabbix ZBX-28194Vendor patch or bulletin · CERT-FR · support.zabbix.com/browse/ZBX-28194, cited by CERT-FR CERTFR-2026-AVI-1261
• Security bulletin: Zabbix ZBX-28195Vendor patch or bulletin · CERT-FR · support.zabbix.com/browse/ZBX-28195, cited by CERT-FR CERTFR-2026-AVI-1261
• Security bulletin: Zabbix ZBX-28197Vendor patch or bulletin · CERT-FR · support.zabbix.com/browse/ZBX-28197, cited by CERT-FR CERTFR-2026-AVI-1261
• Security bulletin: Zabbix ZBX-28198Vendor patch or bulletin · CERT-FR · support.zabbix.com/browse/ZBX-28198, cited by CERT-FR CERTFR-2026-AVI-1261
• Security bulletin: Zabbix ZBX-28193Vendor patch or bulletin · CERT-FR · support.zabbix.com/browse/ZBX-28193, cited by CERT-FR CERTFR-2026-AVI-1261
• Security bulletin: Zabbix ZBX-28196Vendor patch or bulletin · CERT-FR · support.zabbix.com/browse/ZBX-28196, cited by CERT-FR CERTFR-2026-AVI-1261

[ Advisories ]Government CERT advisories

• CERT-FR5 Oct 2026CERTFR-2026-AVI-1261

  Multiple vulnerabilities in Zabbix Translated from French

  Multiple vulnerabilities have been discovered in Zabbix. Some of them allow an attacker to cause remote denial of service, a breach of data confidentiality and a breach of data integrity.

  CVE-2026-59785CVE-2026-59786CVE-2026-59782+3 more CVEs
• BSI CERT-Bund4 Oct 2026WID-SEC-2026-3724

  Zabbix: Multiple vulnerabilities Translated from German

  CVE-2026-59783CVE-2026-59782CVE-2026-59787+2 more CVEs

[ References ]References

• support.zabbix.com/browse/ZBX-28197