CVE-2026-23920: Zabbix

High severity, CVSS 8.8. EPSS: 0.3% chance of exploitation in the next 30 days.

Host and event action script input is validated with a regex (set by the administrator), but the validation runs in multiline mode. If ^ and $ anchors are used in user input validation, an injected newline lets authenticated users bypass the check and inject shell commands.

Affected products

• Zabbix Zabbix: from 7.0.0, before 7.0.22 (fixed in 7.0.22); from 7.2.0, before 7.2.15 (fixed in 7.2.15); from 7.4.0, before 7.4.6 (fixed in 7.4.6)

Published 2026-03-24. Last modified 2026-09-10.