CVE-2026-59781

Executive Summary

CVE-2026-59781 is a DLL sideloading vulnerability (CWE-427) in the Zabbix Agent Windows installer. When the agent is installed into a custom directory whose access permissions allow unauthorized modification, a local attacker can place a malicious DLL in that directory; the Zabbix Agent process subsequently loads it, yielding code execution with the agent's privileges. No confirmed patch release has been identified by tracked sources (patch confidence 0/4), no public PoC or in-the-wild exploitation has been documented, and the CVE is not listed in CISA KEV; immediate mitigation depends on directory ACL hardening and host-based monitoring.

Technical Analysis

The root cause of CVE-2026-59781 is CWE-427 — Uncontrolled Search Path Element — combined with a missing access-control validation step in the Zabbix Agent installer for Windows. The installer allows the operator to select a custom installation directory but, according to the NVD description, does not verify whether that directory has secure access permissions. If the target directory permits unauthorized users to modify its contents (for example, a partition root, a directory under a user-writable parent such as C:\Users\Public, or any directory whose DACL grants write access to Everyone or Authenticated Users), the vulnerability condition is established.

The failure materializes through the standard Windows DLL search-order mechanism. When the Zabbix Agent service starts, the Windows loader searches the directory containing the executable for imported DLLs before falling back to the system directories. If a dependency is missing, or if the attacker can plant a DLL whose name matches a library the agent resolves at startup or via a dynamic library-loading API, the malicious DLL is loaded into the agent process. Drops in the application's own directory take precedence over system locations, which is precisely what makes the insecure custom installation directory dangerous. The NVD description confirms that the installer "did not verify whether the selected directory had secure access permissions" and that "an attacker could place a malicious DLL that could later be loaded by the application, resulting in DLL sideloading."

The description states the installer "has been hardened to detect potentially unsafe installation directories and now requires explicit user confirmation before proceeding with installation in such locations." This is a design-level remediation that reduces the risk of accidental installation into insecure paths, but it does not retroactively secure hosts already installed into such directories, and no concrete fixed version has been verified by the tracked sources feeding this report (patch confidence 0/4). No specific DLL names, installer versions, file paths, or affected version ranges are disclosed in the NVD description, so the precise import that can be hijacked is unknown. The attack surface is local: exploitation requires an attacker with write access to the agent's installation directory, which in multi-user environments or weakly governed fleets is a realistic precondition. The agent commonly runs with elevated privileges (SYSTEM or a privileged service account), which determines the impact of a successful sideload.

Exploitation Scenarios

No public PoC is available for CVE-2026-59781; the attack chain below is inferred from the vulnerability class (CWE-427 DLL sideloading) and the NVD description.

1. Reconnaissance / target identification: The attacker identifies Windows hosts running Zabbix Agent with an installation directory outside C:\Program Files. Local enumeration can reveal the service executable path, and the attacker inspects the NTFS ACL of the installation directory to confirm their user account (or a broad group) has write/create permission. In large fleets deployed via automation to a fixed custom path, a single ACL review generalizes to many hosts.

2. Triggering the vulnerability: The installer's failure to validate the target directory's access permissions is the enabling flaw. If the installation directory was left writable by unauthorized users, the attacker can add or replace files in it after installation completes. The condition is static — no service restart is required to stage the payload, only to execute it.

3. Payload and execution method: The attacker drops a malicious DLL into the writable installation directory, naming it so that it satisfies a library dependency of the Zabbix Agent process. When the agent service is started or restarted (at boot, by an administrator, or by the attacker if permitted), the Windows loader resolves the dependency from the application directory first and executes the attacker-controlled code inside the agent process. Since the NVD description does not name the specific hijackable library, the attacker would typically analyze the agent binaries to identify an overridable import — this step is inferred from the CWE-427 class, not from disclosed technical details.

4. Post-exploitation impact: The attacker's payload runs with the privileges of the Zabbix Agent service account. If the agent runs as SYSTEM or a privileged account, this constitutes local privilege escalation. The malicious DLL persists on disk, so the sideload re-triggers on every service start, providing persistence independent of other mechanisms. The attacker can then disable or forge agent telemetry — blinding the monitoring platform — and use the host for lateral movement or as a staging point for attacks against the Zabbix server infrastructure.

Impact Assessment

The business impact is arbitrary code execution on Windows hosts where Zabbix Agent was installed into a custom directory with permissive access permissions. The severity is conditional: it requires a local write primitive to the installation directory, but in shared or poorly governed environments that precondition is often met. If the agent service runs with elevated rights, the vulnerability escalates a low-privilege local user to the service account's privilege level, potentially SYSTEM. CVSS is N/A in the source data; no official base score, vector, or subscores are available, and we do not fabricate them. EPSS has not been scored by FIRST.org. CISA KEV lists the CVE as NO, indicating no confirmed exploitation in the wild as of this report.

Affected systems are all Windows hosts running Zabbix Agent installed outside the default protected location with weak directory ACLs. The blast radius is host-local but can be fleet-wide in organizations that automated a common custom install path (e.g., C:\Zabbix) with default inherited permissions across thousands of endpoints. Because the compromised component is an agent that reports telemetry to a central Zabbix server, a sideloaded payload can suppress or forge monitoring data, degrading detection and response capabilities across the environment and enabling further attack activity against the monitoring infrastructure.

Detection Guidance

Detection focuses on three observable behaviors: (a) creation or write of DLL files in Zabbix installation directories or user-writable paths, (b) image-load events where the Zabbix Agent process loads a module from a user-writable or non-standard location, and (c) network delivery of PE/DLL content that could be used to stage the payload. The rules below target the vulnerability class and should be tuned against known-good DLL hashes for the Zabbix agent installation to reduce false positives.

Sigma Rule

title: Potential DLL Sideloading via Zabbix Agent Installation Directory
id: 8f0b5978-6c81-4b7e-9aad-202659781001
status: experimental
description: Detects image-load events where the Zabbix Agent process loads a DLL from a user-writable directory, consistent with DLL sideloading (CVE-2026-59781).
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-59781
author: Valters IT Threat Intelligence
date: 2026/01/01
tags:
    - attack.defense_evasion
    - attack.privilege_escalation
    - attack.t1574.002
    - cve.2026.59781
logsource:
    product: windows
    category: image_load
detection:
    selection:
        Image|endswith:
            - '\zabbix_agentd.exe'
            - '\zabbix_agent.exe'
        ImageLoaded|startswith:
            - 'C:\Users\'
            - 'C:\ProgramData\'
            - 'C:\Windows\Temp\'
            - 'C:\Temp\'
    filter:
        ImageLoaded|endswith:
            - '\zabbix_agentd.exe'
            - '\zabbix_agent.exe'
            - '\zabbix_agent.dll'
    condition: selection and not filter
falsepositives:
    - Legitimate agent plugins or third-party monitoring DLLs loaded from user directories
    - Custom deployments that intentionally load modules from ProgramData
level: high

YARA Rule

/*
   CVE-2026-59781 — Zabbix Agent Windows DLL Sideloading
   Detects PE files containing Zabbix-related strings combined with
   references to user-writable paths, indicative of a payload crafted
   for sideloading into the Zabbix Agent process.
*/
rule CVE_2026_59781_Zabbix_DLL_Sideload
{
    meta:
        author = "Valters IT Threat Intelligence"
        description = "Detects potential CVE-2026-59781 DLL sideloading payloads for Zabbix Agent"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-59781"
        cwe = "CWE-427"
        date = "2026-01-01"

    strings:
        $s_zabbix = "zabbix" ascii nocase
        $s_agent  = "zabbix_agentd" ascii nocase
        $s_api1   = "LoadLibraryA" ascii
        $s_api2   = "GetProcAddress" ascii
        $s_api3   = "CreateRemoteThread" ascii
        $s_path1  = "C:\\Users\\" ascii nocase
        $s_path2  = "\\Temp\\" ascii nocase
        $s_path3  = "\\ProgramData\\" ascii nocase

    condition:
        uint16(0) == 0x5A4D and
        filesize < 5MB and
        ( $s_zabbix or $s_agent ) and
        ( $s_path1 or $s_path2 or $s_path3 ) and
        ( $s_api1 or $s_api2 or $s_api3 )
}

Suricata IDS Rule

# CVE-2026-59781 — PE/DLL payload download over HTTP (possible sideload staging)
alert http any any -> any any (msg:"CVE-2026-59781: Potential Zabbix Agent DLL Sideloading Payload Downloaded (PE over HTTP)"; flow:established,to_client; content:"MZ"; depth:2; http_server_body; fileext:"dll"; classtype:trojan-activity; reference:cve,2026-59781; sid:202659781; rev:1;)

# CVE-2026-59781 — SMB write of a .dll file (UTF-16LE) into a share (payload staging)
alert smb any any -> any any (msg:"CVE-2026-59781: Suspicious DLL Write Over SMB (Sideload Payload Staging)"; flow:established; content:"|2e 00 64 00 6c 00 6c 00|"; within:256; classtype:attempted-user; reference:cve,2026-59781; sid:202659782; rev:1;)

Elastic Detection

EQL rule for DLL creation/write events in user-writable paths:

file where event.action in ("creation", "write")
    and file.name : "*.dll"
    and file.path : ("C:\\Users\\*", "C:\\ProgramData\\*", "C:\\Temp\\*", "C:\\Windows\\Temp\\*")
    and process.name : ("setup*.exe", "zabbix*.exe")

EQL rule for suspicious DLL loads by the Zabbix Agent process:

any where process.name : ("zabbix_agentd.exe", "zabbix_agent.exe")
    and dll.path : ("C:\\Users\\*", "C:\\ProgramData\\*", "C:\\Temp\\*", "C:\\Windows\\Temp\\*")

Splunk SPL Query

Detect anomalous DLL loads by the Zabbix Agent:

index=windows source="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational"
  EventCode=7
  Image IN ("*\\zabbix_agentd.exe", "*\\zabbix_agent.exe")
  ImageLoaded IN ("C:\\Users\\*", "C:\\ProgramData\\*", "C:\\Temp\\*", "C:\\Windows\\Temp\\*")
| stats count min(_time) as first_seen max(_time) as last_seen by host, Image, ImageLoaded

Detect DLL file creation within Zabbix installation directories:

index=windows source="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational"
  EventCode=11 TargetFilename="*.dll"
  (TargetFilename="*\\zabbix_agent*" OR TargetFilename="*\\Zabbix*")
| stats count by host, User, Image, TargetFilename

Wazuh OSSEC Rule

<group name="zabbix_dll_sideload,">
  <rule id="426227" level="12">
    <decoded_as>windows_sysmon</decoded_as>
    <field name="win.system.eventID" type="pcre2">^7$</field>
    <field name="win.eventdata.image" type="pcre2">(?i)\\zabbix_agent(d)?\.exe$</field>
    <field name="win.eventdata.imageLoaded" type="pcre2">(?i)^C:\\(Users|ProgramData|Temp|Windows\\Temp)\\</field>
    <description>CVE-2026-59781: Zabbix Agent loaded DLL from user-writable path (possible DLL sideloading)</description>
    <group>sysmon_event7_load_image,pci_dss_10.6.1,gdpr_IV_35.7.d,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence is 0/4 — UNPATCHED. No patch source, fixed version, or vendor advisory URL has been confirmed by any tracked source. The NVD description references an installer hardening change (explicit user confirmation when an unsafe directory is selected), but this report cannot verify a released, patched installer.

1. Immediate mitigations:

• Audit ACLs on all Zabbix Agent installation directories on Windows hosts (e.g., icacls "<zabbix-install-dir>") and remove write/modify/delete entries for Everyone, Authenticated Users, and Users. Retain write access only for SYSTEM, Administrators, and the agent service account.
• If the agent currently runs from a non-Program Files directory, reinstall to C:\Program Files\Zabbix Agent (or an equivalent protected location) to neutralize the insecure search path.
• Run the Zabbix Agent service under a least-privilege account rather than SYSTEM where operational constraints permit.
• If immediate reinstallation is not possible, apply restrictive DACLs to the existing directory and compare all DLLs present against a known-good hash list to identify already-planted payloads.

2. Patch/upgrade steps:

• Monitor the Zabbix vendor's official channels for a hardened installer; validate any obtained installer's SHA-256 checksum before use.
• Test the updated installer in staging, then redeploy the agent to production. Because tracked patch confidence is 0/4, do not assume a fix exists until the vendor publishes a concrete release.
• After redeployment, verify the new installation directory's ACLs to confirm the hardening condition was applied.

3. Long-term hardening:

• Standardize Zabbix Agent deployments on the default protected directory using configuration management, GPO, or imaging tooling to prevent permissive custom paths.
• Enable Sysmon Event ID 7 (image loaded), Event ID 11 (file create), and Event ID 23 (file delete) fleet-wide; feed the Sigma/Splunk/EQL detection logic into a SIEM.
• Deploy AppLocker or Windows Defender Application Control (WDAC) to allow only signed and trusted binaries and DLLs, breaking the sideload step at execution time.
• Apply the principle of least privilege to local users on monitored hosts and restrict interactive logon to reduce the local-write precondition.
• Periodically re-check the CISA KEV catalog and FIRST EPSS feed for status changes to CVE-2026-59781.

References

1. NVD entry for CVE-2026-59781: https://nvd.nist.gov/vuln/detail/CVE-2026-59781
2. MITRE CWE-427 — Uncontrolled Search Path Element: https://cwe.mitre.org/data/definitions/427.html
3. MITRE ATT&CK T1574.002 — Hijack Execution Flow: DLL Side-Loading: https://attack.mitre.org/techniques/T1574/002/
4. CISA Known Exploited Vulnerabilities Catalog (CVE-2026-59781 not currently listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
5. Zabbix official site (vendor advisories and download verification): https://www.zabbix.com/

Known threat-actor campaigns / exploit-in-the-wild evidence: None identified in the provided data. CISA KEV status is NO, EPSS is not yet scored by FIRST.org, and no public PoC or exploit code is available. The vendor is Zabbix per the NVD description ("Zabbix Agent" for Windows); no vendor advisory URL or researcher analysis was provided in the source data.