Zabbix Server/Proxy Denial of Service via JS Preprocessing Script
CVE-2026-23938 Published on August 18, 2026
Server DoS via JavaScript preprocessing or script items
An authenticated administrator is able to crash Zabbix server or proxy by creating specifically crafted preprocessing/script item JavaScript scripts, leading to potential denial of service.
Vulnerability Analysis
CVE-2026-23938 is exploitable with network access, and requires user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity and availability.
Weakness Type
Uncaught Exception
An exception is thrown from a function, but it is not caught. When an exception is not caught, it may cause the program to crash or expose sensitive information.
Products Associated with CVE-2026-23938
Want to know whenever a new CVE is published for Zabbix? stack.watch will email you.
Affected Versions
Zabbix:- Version 6.0.0, <= 6.0.46 is affected.
- Version 7.0.0, <= 7.0.26 is affected.
- Version 7.4.0, <= 7.4.10 is affected.