CVE-2025-27240: Zabbix

High severity, CVSS 7.2. EPSS: 1.3% chance of exploitation in the next 30 days.

A Zabbix adminitrator can inject arbitrary SQL during the autoremoval of hosts by inserting malicious SQL in the 'Visible name' field.

Affected products

• Zabbix Zabbix: from 6.0.0, before 6.0.34 (fixed in 6.0.34); from 6.4.0, before 6.4.19 (fixed in 6.4.19); from 7.0.0, before 7.0.4 (fixed in 7.0.4)

Published 2025-09-12. Last modified 2026-06-17.