CVE-2026-1199: Zabbix

Low severity, CVSS 3.7. EPSS: 0.2% chance of exploitation in the next 30 days.

Zabbix API and Frontend login lockout mechanism has a flaw where several unsuccessful login requests are not properly counted towards the block counter if sent simultaneously, potentially allowing for more password guesses than intended.

Affected products

• Zabbix Zabbix: from 6.0.0, before 6.0.47 (fixed in 6.0.47); from 7.0.0, before 7.0.28 (fixed in 7.0.28); from 7.4.0, before 7.4.12 (fixed in 7.4.12)

Published 2026-08-18. Last modified 2026-09-08.