CVE-2025-27231: Zabbix

Medium severity, CVSS 4.9. EPSS: 0.5% chance of exploitation in the next 30 days.

The LDAP 'Bind password' value cannot be read after saving, but a Super Admin account can leak it by changing LDAP 'Host' to a rogue LDAP server. To mitigate this, the 'Bind password' value is now reset on 'Host' change.

Affected products

• Zabbix Zabbix: from 6.0.0, before 6.0.41 (fixed in 6.0.41); from 7.0.0, before 7.0.18 (fixed in 7.0.18); from 7.2.0, before 7.2.12 (fixed in 7.2.12); from 7.4.0, before 7.4.2 (fixed in 7.4.2)

Published 2025-10-03. Last modified 2026-06-17.