CVE-2026-23935

Executive Summary

CVE-2026-23935 is an out-of-bounds (OOB) memory read vulnerability affecting Zabbix, a widely used enterprise monitoring platform. A Zabbix administrator can exploit a flaw in the JavaScript HttpRequest logic used by script items and preprocessing rules to read memory beyond an allocated buffer, resulting in a potential confidentiality loss of sensitive server memory contents. As of this report, no patch is available, no public exploit has been confirmed, and the vendor has not released an official advisory beyond the minimal CVE description.

Technical Analysis

The vulnerability exists in Zabbix's implementation of script items and preprocessing steps, which allow administrators to write JavaScript to perform custom data transformations or HTTP requests. The NVD description specifically identifies the HttpRequest logic inside this JavaScript environment as the source of the flaw. When a Zabbix administrator constructs or executes a script that invokes HttpRequest functionality, the underlying code can read out-of-bounds memory, i.e., it accesses a memory region beyond the intended buffer boundary. This is classified as CWE-125 (Out-of-bounds Read).

From a technical standpoint, the attack surface is the Zabbix frontend and server-side script execution engine. The flaw is triggered not by an unauthenticated remote attacker, but by an authenticated user with administrator privileges. This elevates the severity because the administrator role already has high configuration control; however, the vulnerability breaks the implicit security boundary within the Zabbix server process itself. By carefully crafting JavaScript that interacts with HttpRequest, an administrator could potentially leak adjacent memory, which may contain credentials, authentication tokens, secrets, or other sensitive data belonging to other users, monitored hosts, or the underlying operating system.

No specific function names, API endpoints, or file paths are provided in the public description, so a function-level analysis is not possible. The flaw is best understood as a memory-safe programming bug in a C/C++ native component that binds JavaScript to HTTP client functionality. The absence of a CVSS vector and patch information further indicates that the issue has neither been fully analyzed nor remediated in a public release. The OOB read may also lead to subsequent denial-of-service if the read triggers a segmentation fault, although the primary impact is listed as confidentiality loss.

Exploitation Scenarios

The exploit chain for CVE-2026-23935 is inferred from the vulnerability class and the limited details in the NVD description. No public PoC or exploit code has been observed, and the following steps are based on the required role and the described trigger.

1. Reconnaissance / Target Identification
   An attacker must first gain valid administrator credentials to the Zabbix web interface. This can be achieved through credential theft, social engineering, or legitimate access as a malicious insider. The target is any Zabbix server that exposes the web frontend and supports JavaScript script items or preprocessing rules. Public-facing Zabbix instances can be located using Shodan queries such as http.title:"Zabbix" or by scanning for the Zabbix server port (10051).

2. Trigger of the Flaw
   The attacker navigates to the Zabbix configuration area and either creates a new script item or modifies an existing preprocessing rule. In this configuration, they write JavaScript code that calls the vulnerable HttpRequest functionality. The actual exploitation is not dependent on a specific endpoint; rather, the attacker supplies an input that causes the HttpRequest implementation to read more bytes than allocated. This could be an oversized response, malformed headers, or a special argument to the HTTP request call. The exact payload is unknown, but the vulnerability class suggests a memory boundary miscalculation during HTTP response processing.

3. Payload / Execution Method
   Because the flaw is in the JavaScript HttpRequest logic, the payload is delivered as JavaScript code. The script executes server-side when the item is polled or when preprocessing is applied to a collected value. By intentionally inducing an anomalous HTTP response or sending crafted parameters, the attacker forces the HttpRequest function to read out-of-bounds memory. The leaked bytes are then echoed back into the Zabbix item value or preprocessing result, where the attacker can view them through the frontend or via API. This is a classic information-disclosure technique over a trusted administrative channel.

4. Post-Exploitation Impact
   After successful exploitation, the attacker retrieves memory contents that may include session cookies, internal IP addresses, API keys, or other secrets from the Zabbix server's address space. If the server stores credentials for monitored systems (e.g., SNMP community strings, SSH keys, Windows agent credentials), these could be exfiltrated and reused laterally. Even without additional credentials, the attacker gains an unauthorized visibility into the server's memory, violating data confidentiality and potentially compromising the entire monitoring infrastructure.

Impact Assessment

The business impact of CVE-2026-23935 is largely centered on data confidentiality and assumes the attacker already holds Zabbix administrator privileges. In many enterprises, Zabbix administrators are already in a position of significant trust; however, the flaw extends that trust beyond intended bounds, allowing access to memory of the Zabbix server process. This could expose credentials for connected systems, thereby transforming a monitoring platform administrator into a lateral movement pivot.

Affected systems are those running Zabbix with JavaScript script items or preprocessing enabled, which is a common feature in enterprises that require flexible data transformation. The exact affected version range is unknown, which complicates triage for security teams. The lack of a CVSS vector means risk scoring must be performed manually. Given the pre-authentication requirement (administrator role) and the confidentiality impact, this would likely rate as a medium to high severity issue in absence of a CVE score. If the OOB read can also cause a crash, availability could be impacted, further raising the risk.

The blast radius is contained to the Zabbix server itself and any systems that depend on it. Because Zabbix often holds credentials for many monitored assets, a memory leak can have cascading effects. There is no evidence of exploitation in the wild, and no threat actor campaigns have been linked to this CVE, but the absence of a patch increases the exposure window for organizations relying on Zabbix in production.

Detection Guidance

The following detection rules are designed to identify suspicious activity that could be associated with exploitation of CVE-2026-23935. Because no specific exploit signature is known, these rules focus on behavioral detection — specifically, the creation or modification of script items containing HttpRequest code, and any resulting memory-related anomaly in Zabbix processes. Adjust the underlying log sources (Zabbix audit logs, web server access logs, process execution logs) to match your environment.

Sigma Rule

title: Zabbix Script Item HttpRequest Out-of-Bounds Memory Read Attempt
id: 97b2c4d1-6e1a-4a5f-9c8b-3a1b2f0e7c10
status: experimental
description: Detects creation or modification of Zabbix script items containing HttpRequest JavaScript code, which may indicate attempted exploitation of CVE-2026-23935.
logsource:
  product: zabbix
  service: audit
detection:
  selection:
    resource_like: "script"
    operation:
      - "create"
      - "update"
    details|contains: "HttpRequest"
  condition: selection
falsepositives:
  - Legitimate use of HTTP script items for data enrichment
  - Administrative configuration changes in Zabbix
level: high
tags:
  - attack.t1005
  - cve.2026.23935
  - cwe.125

YARA Rule

rule Zabbix_HttpRequest_OOB_Read
{
    meta:
        description = "Detects Zabbix script configurations referencing HttpRequest with potential out-of-bound memory indicators"
        author = "Valtersit Threat Intelligence"
        date = "2026-04-11"
        cve = "CVE-2026-23935"
        cwe = "125"
    strings:
        $a = "HttpRequest" ascii nocase
        $b = "/api_jsonrpc.php" ascii
        $c = "preprocessing" ascii nocase
        $d = "scriptType" ascii nocase
    condition:
        all of them and filesize < 500KB
}

Note: This YARA rule is intended to scan exported Zabbix configuration files or memory dumps for patterns matching both script configurations and the vulnerable HttpRequest call. Since the rule relies on generic strings, it may produce false positives on legitimate configuration backups.

Suricata IDS Rule

alert http any any -> any any (msg:"Zabbix Script Item HttpRequest Out-of-Bound Read Request"; flow:established; content:"/api_jsonrpc.php"; http_uri; content:"\"method\":\"script.create\""; http_client_body; nocase; content:"HttpRequest"; http_client_body; nocase; sid:202623935; rev:1; metadata:cve CVE-2026-23935;)

Note: This rule monitors for POST requests to Zabbix API that attempt to create a script item (.method: "script.create") and include the HttpRequest string in the body. It is a heuristic rule based on the exploit vector; network traffic from the Zabbix server to external hosts may also need monitoring.

Elastic Detection

sequence with maxspan=10m
  [ any where process.name == "zabbix_server" and event.action == "start" ]
  [ file where event.action in ("create", "modify") and file.path : "*script*" and file.name : "*.js" and file.text : "*HttpRequest*" ]

Note: This EQL sequence looks for a Zabbix server restart followed by the creation or modification of a JavaScript file under a script directory containing HttpRequest. In environments where Zabbix stores scripts on disk, this may indicate an attempted weaponization. If Zabbix uses a database-backed script store, adjust the query to audit log inputs.

Splunk SPL Query

index=zabbix sourcetype=zabbix:audit
    (resource="script" OR resource="item")
    OR (data IN ("*HttpRequest*") OR details IN ("*HttpRequest*"))
    operation IN ("create","update")
| table _time, user, resource, operation, details, src_ip
| sort - _time

Note: Query the Zabbix audit logs for events where a script or item resource is created or updated and the payload contains HttpRequest. Correlate with the actor's username and source IP to identify unexpected administrative actions. Tune based on your specific CIM field mapping.

Wazuh OSSEC Rule

<group name="zabbix,">
  <rule id="100239" level="12">
    <decoded_as>zabbix_audit</decoded_as>
    <match>HttpRequest</match>
    <regex>operation: (create|update)</regex>
    <description>Zabbix script item with HttpRequest created or modified - possible CVE-2026-23935 exploitation</description>
    <group>cve-2026-23935,</group>
  </rule>
</group>

Note: This Wazuh rule assumes that Zabbix audit logs are parsed into a custom decoder that extracts operation and message fields. The rule will fire on any create/update operation containing HttpRequest. It should be tuned to exclude known legitimate administrators.

Mitigation & Patch Guidance

The vendor has not yet released a patch for CVE-2026-23935, and the patch confidence is 0/4. Until a fixed version is available, organizations should take immediate and longer-term actions to reduce the risk of exploitation.

1. Immediate Mitigations

   • Restrict Zabbix administrator access to only a small set of trusted users. Use multi-factor authentication for all Zabbix accounts, especially those with administrative roles.
   • Review and remove any unused script items or preprocessing rules that reference HttpRequest. Temporarily disable JavaScript preprocessing if it is not required for core monitoring functions.
   • Apply the principle of least privilege: use role-based access control in Zabbix and ensure that only necessary users can create or modify scripts.
   • Monitor Zabbix audit logs for unusual script item creation/modification events and alert on them.
   • Segment the Zabbix server from other critical systems and restrict outbound network connectivity from the server to reduce the impact of memory leak data exfiltration.

2. Patch / Upgrade Steps

   • Monitor official Zabbix security advisories for a patched release. When available, upgrade the Zabbix server to the fixed version as soon as possible.
   • Before upgrading, review the Zabbix upgrade documentation and take a full backup of the Zabbix database and configuration files.
   • Test the patched version in a staging environment to ensure compatibility with existing monitoring and script item configurations.

3. Long-Term Hardening

   • Enforce a formal change-management process for any modification of Zabbix scripts and preprocessing rules.
   • Implement an ongoing vulnerability scanning program that includes CVE-2026-23935, and feed the CVE ID into enterprise threat intelligence and SIEM correlation rules.
   • Regularly review the necessity of JavaScript execution capabilities in Zabbix and consider sandboxing or isolating the monitoring server in a separate network zone.
   • Maintain up-to-date incident response procedures that include out-of-bounds read vulnerability response playbooks.

References

The following references are authoritative sources for CVE-2026-23935. No vendor advisory, researcher blog, or CISA KEV registration was available at the time of this report.

• NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-23935
• CWE-125 Out-of-bounds Read: https://cwe.mitre.org/data/definitions/125.html
• Zabbix Official Security Advisories (future advisories): https://www.zabbix.com/security_advisories
• ATT&CK Technique T1005 (Data from Local System): https://attack.mitre.org/techniques/T1005/
• CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat Actor Campaigns / Exploitation Evidence: As of this report, there is no confirmed evidence of in-the-wild exploitation, no public exploit code, and no known threat actor campaigns associated with CVE-2026-23935. This assessment may change if new information emerges, and the report should be updated accordingly.