CVE-2026-23921: Zabbix

High severity, CVSS 8.8. EPSS: 3.9% chance of exploitation in the next 30 days.

A low privilege Zabbix user with API access can exploit a blind SQL injection vulnerability in include/classes/api/CApiService.php to execute arbitrary SQL selects via the sortfield parameter. Although query results are not returned directly, an attacker can exfiltrate arbitrary database data through time-based techniques, potentially leading to session identifier disclosure and administrator account compromise.

Affected products

• Zabbix Zabbix: from 7.0.0, before 7.0.22 (fixed in 7.0.22); from 7.2.0, before 7.2.15 (fixed in 7.2.15); from 7.4.0, before 7.4.6 (fixed in 7.4.6)

Published 2026-03-24. Last modified 2026-09-10.