CVE-2026-23933
criticalIn Zabbix 7.4 the cryptographic key used for signing Frontend sessions has been erroneously written to the database seed.
Vendor / product: Zabbix — zabbix
In Zabbix 7.4 the cryptographic key used for signing Frontend sessions has been erroneously written to the database seed. Currently the only known exploitation scenario is for deployments that utilize both - SAML authentication and guest users. In such cases the key can be used to forge valid session cookies, potentially leading to unauthorized access. For other Zabbix deployments this does not have a known impact.
CVSS
9.1
9.1 (CVSS v3.1)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N Severity source: NVD CVSS v3.1 (nvd@nist.gov)
Timeline (UTC)
Published: 2026-08-18 13:17
Modified: 2026-09-23 14:31
NVD status: Analyzed
Last synced 2 days ago
Verified against the source API 2026-10-27 07:07 UTC
Exploitation
Not listed in CISA KEV (as of last catalog sync)
Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).
Affected products
zabbix / zabbix ≥7.4.0 <7.4.11
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
Vendor advisory: https://support.zabbix.com/browse/ZBX-28071
References
- https://support.zabbix.com/browse/ZBX-28071 security@zabbix.com
Data sources
NVD CVE API 2.0 — fetched 2026-10-27 07:07 UTC · record ↗