Vulnerability in Zabbix

[ Description ]Official description

The email media type OAuth form passes the Authorization endpoint value to window.open() without validating the URL scheme, so a javascript: URL is executed in the browser. This means a crafted media type configuration, deliverable as an import file, runs arbitrary JavaScript as the Super Admin who grants consent.

[ Fixes ]Fixes and patches

• Security bulletin: Zabbix ZBX-28194Vendor patch or bulletin · CERT-FR · support.zabbix.com/browse/ZBX-28194, cited by CERT-FR CERTFR-2026-AVI-1261
• Security bulletin: Zabbix ZBX-28195Vendor patch or bulletin · CERT-FR · support.zabbix.com/browse/ZBX-28195, cited by CERT-FR CERTFR-2026-AVI-1261
• Security bulletin: Zabbix ZBX-28197Vendor patch or bulletin · CERT-FR · support.zabbix.com/browse/ZBX-28197, cited by CERT-FR CERTFR-2026-AVI-1261
• Security bulletin: Zabbix ZBX-28198Vendor patch or bulletin · CERT-FR · support.zabbix.com/browse/ZBX-28198, cited by CERT-FR CERTFR-2026-AVI-1261
• Security bulletin: Zabbix ZBX-28193Vendor patch or bulletin · CERT-FR · support.zabbix.com/browse/ZBX-28193, cited by CERT-FR CERTFR-2026-AVI-1261
• Security bulletin: Zabbix ZBX-28196Vendor patch or bulletin · CERT-FR · support.zabbix.com/browse/ZBX-28196, cited by CERT-FR CERTFR-2026-AVI-1261

[ Advisories ]Government CERT advisories

• CERT-FR5 Oct 2026CERTFR-2026-AVI-1261

  Multiple vulnerabilities in Zabbix Translated from French

  Multiple vulnerabilities have been discovered in Zabbix. Some of them allow an attacker to cause remote denial of service, a breach of data confidentiality and a breach of data integrity.

  CVE-2026-59785CVE-2026-59786CVE-2026-59782+3 more CVEs
• BSI CERT-Bund4 Oct 2026WID-SEC-2026-3722

  Zabbix (Frontend): Vulnerability allows cross-site scripting Translated from German

  CVE-2026-59788

[ References ]References

• support.zabbix.com/browse/ZBX-28198