CVE-2026-23930

Executive Summary

CVE-2026-23930 is an unauthenticated denial-of-service vulnerability in the Zabbix Frontend webserver component. An attacker exploiting this flaw can submit specifically crafted requests to the popup.testtriggerexpr action, causing disproportionately high CPU consumption on the affected server. This vulnerability carries a CVSS score of 7.5 (High) with a network attack vector, low attack complexity, no privilege requirements, and no user interaction — making it remotely exploitable by any unauthenticated party. The primary impact is a High availability impact (CVSS sub-score A:H), meaning affected Zabbix monitoring infrastructure can be rendered unavailable, disrupting the organization's ability to monitor its own systems and services.

Technical Analysis

The vulnerability resides in the Zabbix Frontend web interface, specifically within the popup.testtriggerexpr action. This action is part of the Zabbix popup-handling subsystem designed to facilitate interactive web UI functionality — in this case, related to testing trigger expressions within the frontend interface.

Vulnerability Mechanism

An unauthenticated attacker is able to reach the popup.testtriggerexpr action without any session or authentication requirements. By crafting requests that specifically target the expression-evaluation logic of this action, the attacker causes the frontend web server to process computationally expensive operations. Alarmingly, despite the request volume being potentially small, the CPU consumption per request is disproportionately high — a hallmark of algorithmic complexity vulnerabilities (CWE-405: Asymmetric Resource Consumption, also commonly referred to as "algorithmic complexity" or "resource amplification").

The CWE-405 classification indicates that the vulnerability involves a scenario where the attacker's cost of sending a request is substantially lower than the server's cost of processing it. In this case, the "asymmetric resource consumption" is specifically realized through CPU load amplification: a small number of crafted requests can spike CPU utilization to critical levels.

Attack Surface

• Target Component: Zabbix Frontend (Webserver component)
• Authentication Required: None — the attacker does not need credentials
• Network Exposure: The attack requires network access to the Zabbix frontend HTTP/HTTPS endpoint
• HTTP Method: Not specified in public data, but POST requests are likely given that expression testing typically involves form-based submission

Technical Details Known

The NVD description names the specific frontend action endpoint popup.testtriggerexpr. Zabbix frontend actions are typically routed via PHP controllers and are invoked through HTTP requests that include the action name as a routing parameter (commonly via the action parameter in POST bodies or GET query strings). The underlying mechanism likely involves the evaluation or parsing of trigger expressions supplied by the request — an operation that, when supplied with pathological or structurally complex expressions, can consume excessive CPU cycles.

However, the public NVD data does not expose the specific PHP function internals, parameter names for the expression payload, or the precise algorithmic defect causing the CPU amplification. A moderate-to-high confidence assessment is that the flaw lies in an expression parser or validation routine that does not properly bound input complexity or recursion depth. Without vendor confirmation or an independent technical analysis, implementation-level detail beyond the action name cannot be responsibly asserted.

Exploitation Scenarios

ATT&CK Mapping

This vulnerability maps most directly to T1498 — Network Denial of Service, because it causes availability losses on the frontend webserver. It can also be considered a subset of T1499.001 (Resource Hijacking → CPU Capacity) if the attacker's objective is to consume server CPU capacity. Because the attack is unauthicated and network-based with no user interaction, it represents a persistent threat from internet-facing or compromised-network sources.

Attack Chain

Step 1 — Reconnaissance / Target Identification

The attacker first identifies Zabbix frontend instances. Because Zabbix ships with a distinctive login page that references the product name and sometimes includes the version banner, scanning is straightforward. The attacker will look for:

• HTTP/HTTPS services on common ports (8080, 80, 443)
• HTTP responses containing "Zabbix" in the HTML body or title
• Server headers or page footers revealing "Zabbix" version information

Shodan and comparable internet-scanning services can trivially identify such targets on a global scale using searches such as product:"Zabbix" or http.html:"zabbix".

Step 2 — Triggering the Vulnerability

Once a Zabbix frontend is identified, the attacker crafts HTTP requests directed at the popup.testtriggerexpr action. Because the service is unauthenticated to that action, no session tokens, credentials, or pre-authentication steps are required. The attacker would submit payloads designed to maximize CPU utilization by the backend expression-handling logic.

Based on the vulnerability class (CWE-405 — asymmetric resource consumption), the attacker likely sends either:

• A low volume of extremely complex or pathological expressions designed to cause deep parsing recursion or catastrophic backtracking
• Repeated valid-looking requests that aggregate CPU consumption until the processor saturates

Step 3 — Payload Execution

At the vulnerability-class level, the payload is an HTTP request to the frontend containing trigger-expression input structured to exploit the algorithmic flaw. Whether the amplification arises from regular-expression backtracking, deeply nested data structures, or recursion in the parser, the net effect is identical: CPU consumption vastly disproportionate to request cost. Observational data in the NVD description is unambiguous that the requests were "specifically crafted" — indicating an attacker who understands the underlying expression grammar can reliably reproduce the amplification.

Step 4 — Post-Exploitation Impact

Once CPU is saturated:

• The frontend webserver becomes unresponsive to legitimate users
• Zabbix dashboard, alerting, and visibility tools become unavailable
• If the denial of service persists, alerting interruptions may mean that underlying infrastructure incidents go undetected during the attack window — this is a secondary cascading effect where attacking monitoring infrastructure indirectly blinds the SOC team to other malicious activity

Note on public PoC: The NVD data indicates no private or public exploit code is available, nor is a Nuclei template known to exist. The attack chain is inferred from the vulnerability class and description. No independently confirmed exploit demonstration is publicly available at the time of writing.

Impact Assessment

CVSS Breakdown

• Attack Vector (AV:N): Network-only exploitation — the attacker must reach the frontend over the network; the frontend HTTP/HTTPS service is the sole attack surface
• Attack Complexity (AC:L): No special conditions required — no race conditions, no specific timing, no exotic network positioning beyond basic reachability
• Privileges Required (PR:N): None — no Zabbix user account is needed
• User Interaction (UI:N): None — no legitimate user must click anything or perform any action in the UI
• Confidentiality Impact (C:N): Not affected
• Integrity Impact (I:N): Not affected
• Availability Impact (A:H): The affected component (frontend webserver) can be reduced to an unusable state via CPU exhaustion

Business Impact

Zabbix is widely deployed as an enterprise monitoring platform. A denial of service against the frontend has several compounding business effects:

1. Monitoring Blackout: Operators lose access to dashboards, alert views, trigger status, and reporting. This degrades the organization's ability to respond to incidents that may be occurring in parallel with the DoS attack.
2. Alert Suppression: If the frontend mediates alert acknowledgement or escalation workflows, those management functions become unavailable.
3. Incomplete Forensic Picture: If the attack coincides with other malicious activity (a common tactic called "defense evasion through monitoring compromise"), the victim organization may be unable to observe the attacker's other actions due to frontend unavailability.
4. Operational Confidence: Even after service restoration, SOC teams may have to manually reconcile events that occurred during the outage, potentially introducing errors in audit logs.

The single affected component (the Zabbix Frontend) implies that back-end Zabbix servers and database components are not directly impacted. The blast radius is limited to the presentation and interaction layer.

Criticality Assessment

The CVSS score of 7.5 (High) combined with a documented EPSS score of 0.00172 (6.7th percentile among exploited CVEs) indicates that this vulnerability is not currently among the most actively exploited CVE classes. The CISA Known Exploited Vulnerabilities catalog does not include this CVE, meaning no confirmed government-sponsored or widespread exploitation has been reported. However, public PoC content existed in some form per the data, Signifying the exploitation barrier is not trivial but also not prohibitive.

Detection Guidance

Sigma Rule

The following Sigma rule detects HTTP requests reaching the Zabbix frontend targetting the popup.testtriggerexpr action in proximity (high-frequency or abnormally bursty patterns):

title: Zabbix Frontend popup.testtriggerexpr DoS Attempt
id: 4e8e9de1-4c66-4d0e-9a02-9b9fc34c98cd
status: experimental
description: >
  Detects attempts to exploit CVE-2026-23930, an unauthenticated CPU
  resource exhaustion vulnerability in the Zabbix Frontend
  popup.testtriggerexpr action.
author: Valtersit Threat Intel Team
date: 2026/02/10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-23930
logsource:
    category: webserver
    product: zabbix
detection:
    selection:
        cs-uri-query|contains: 'popup.testtriggerexpr'
    filter_normal:
        c-ip: null
    timeframe: 5m
    condition:
        selection and not filter_normal
        | count(c-ip) by c-ip > 100
level: medium
falsepositives:
    - High-frequency legitimate users working in the Zabbix trigger-testing UI
    - Automation systems that call the trigger testing endpoint
fields:
    - c-ip
    - cs-uri-query
    - sc-status
tags:
    - attack.t1498
    - cve.2026-23930

YARA Rule

The following YARA rule scans PCAP captures or web-server access log files for request patterns to the vulnerable action:

rule Zabbix_CVE2026_23930_Popup_Trigger {
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detect crafted requests targeting Zabbix popup.testtriggerexpr action"
        cve = "CVE-2026-23930"
        date = "2026-02-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-23930"
        score = 75
    strings:
        $s1 = "popup.testtriggerexpr" ascii wide
        $s2 = "testtriggerexpr" ascii wide
        $s3 = "popup" ascii wide
        $s4 = "action=" ascii wide
    condition:
        any of ($s1, $s2) and any of ($s3, $s4)
}

Suricata IDS Rule

The Suricata rule inspects HTTP URI content for the vulnerable action name and flags either repeated exposure or burst characteristics (tracking each source IP):

alert http any any -> any any \
    (msg:"Zabbix CVE-2026-23930 popup.testtriggerexpr DoS Attempt"; \
     flow:established,to_server; \
     http.uri; content:"popup.testtriggerexpr"; nocase; \
     reference:cve,2026-23930; \
     classtype:attempted-dos; \
     metadata:created_at 2026_02_10, updated_at 2026_02_10; \
     threshold: type both, track by_src, count 15, seconds 60; \
     sid:2026023910; rev:1;)

Elastic Detection

Elastic EQL rule that flags unusual frequency of requests toward the action over a short window:

sequence by source.ip with maxspan=5m
  [ network where dns.question.name == "zabbix" or http.request.body :
      "*popup.testtriggerexpr*" ]
  | count by http.request.body >= 100

Alternatively, an event-focused EQL for web access logs indexed in Elasticsearch:

sequence by source.ip with maxspan=5m
  [ filebeat where http.request.uri : "*popup.testtriggerexpr*" ]
  with runs = 100

Splunk SPL Query

Splunk SPL that identifies a source IP issuing a disproportionate number of requests to the vulnerable action within a defined window:

index=web sourcetype=access_combined uri_path=*popup.testtriggerexpr*
| bucket _time span=5m
| stats count as requests by src_ip, _time
| where requests > 50
| table _time, src_ip, requests
| sort - requests

If the earlier URI form is not discernible in logs, a broader query on the action parameter value is recommended.

Wazuh OSSEC Rule

Wazuh XML ruleset entry for detecting requests to the action in Apache or Nginx access logs;

<group name="zabbix,">
  <rule id="100321" level="10">
    <decoded_as>web-accesslog</decoded_as>
    <match>popup.testtriggerexpr</match>
    <description>Zabbix CVE-2026-23930 popup.testtriggerexpr access detected - potential DoS attempt</description>
    <group>attack.t1498,cve-2026-23930,</group>
    <mitre>
      <id>T1498</id>
    </mitre>
    <frequency>20</frequency>
    <timeframe>60</timeframe>
    <same_source_ip />
    <options>no_full_log</options>
  </rule>
</group>

Frequency-based rules require the time/quiet and same_source_ip parameters to be properly aligned with the parsers in your Wazuh deployment to avoid false positives.

The above rule counts 20 matching events in a 60-second window from a single source IP before firing (level 10). This balances detection against occasional legitimate UI interactions from administrators.

Mitigation & Patch Guidance

Patch Confidence: 2/4 (CLAIMED). A single source (NVD) claims a fix exists; however, no specific patched version, commit ID, or other corroborating reference is available. This patch should be treated cautiously until independently verified by Zabbix's official channels.

Immediate Mitigations (Without Patch)

1. Restrict Frontend Access: If the Zabbix frontend is internet-facing, place it behind a VPN, bastion host, or firewall that permits access only from trusted administrative networks. Zabbix frontends rarely require internet-exposed access for legitimate operations.
2. Web Application Firewall (WAF) Rules: Deploy WAF rules that block requests containing the popup.testtriggerexpr action string from unauthenticated sources. For authenticated sources, consider requiring additional scrutiny or rate-limiting.
3. Rate Limiting: Apply per-source IP request-rate limits at the web server or reverse proxy layer. A rule that allows no more than 5-10 requests per minute to the vulnerable action per source IP will neutralize the DoS amplification without disrupting normal UI usage patterns.
4. Network Segmentation: Ensure the Zabbix web frontend is isolated in a network zone with limited inbound reachability from lower-security zones.
5. HTTP Request Body Limits: Set conservative maximum HTTP request size limits at the proxy or web server. Because the vulnerable action involves expression payloads, restricting the maximum payload length reduces the potential for CPU-intensive parsing scenarios.

Patch / Upgrade Steps

1. Check the official Zabbix security advisory pages and the vendor's download portal for the patched version that addresses CVE-2026-23930.
2. Before upgrading, review the Zabbix release notes and upgrade guide for the target version to anticipate breaking changes.
3. Deploy the patch in a staging environment, re-running trigger expression tests to verify no regressions in the trigger-testing functionality.
4. After successful staging validation, schedule the production frontend upgrade during the organization's change-window. Note the frontend and Zabbix server components may require coordinated version alignment — consult the vendor's compatibility matrices.
5. If the vendor has not yet issued a fixed release, pursue mitigations above and revisit for patch installation at 30-day intervals.

Long-Term Hardening

1. Monitor for vendor advisories on the public Zabbix security page. The single-source patch claim is not authoritative until published by Zabbix.
2. Incident Response Readiness: Because this attack can be chained with the attacker's other activities (taking the monitoring system down to blind the SOC), ensure secondary log sources outside of Zabbix are retained (e.g., firewall logs, host logs shipped directly to the SIEM without relying on Zabbix). See the "Monitoring Blackout" cascading risks described in the Impact section.
3. Implement a broader monitoring capability in the Zabbix frontend hosts themselves — both for CPU utilization (baseline and anomaly detection) and for unusual HTTP patterns. The frontend host should be enrolled in an external monitoring solution that does not depend on the Zabbix instance being attacked.
4. Periodically review publicly available Zabbix security bulletins for similar frontend action vulnerabilities; the pattern of unauthenticated action access should be checked for other endpoints in the same component family.

References

1. NVD Entry: CVE-2026-23930 — https://nvd.nist.gov/vuln/detail/CVE-2026-23930
2. CWE-405 (Asymmetric Resource Consumption) — https://cwe.mitre.org/data/definitions/405.html
3. Zabbix Official Security Advisories: https://support.zabbix.com/browse/ (check the Security section for vendor bulletins)
4. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (confirms CVE-2026-23930 is NOT on the KEV list as of publication)
5. FIRST EPSS: https://www.first.org/epss/ (for EPSS score tracking and likelihood-of-exploitation metrics)

Threat Actor Campaign Data: No specific threat actor campaigns or in-the-wild exploit evidence are known at the time of writing. The CISA KEV catalog does not list this CVE. Since the EPSS percentile is only 6.7% among exploited CVEs, the likelihood of current mass exploitation is assessed as low. Public PoC evidence exists at a summary level, but no production-grade exploit code has been observed. This status should be re-assessed regularly as the vulnerability becomes better understood post-disclosure.