Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
For performance reasons Zabbix Server/Proxy reuses JavaScript (Duktape) contexts (used in script items, JavaScript reprocessing, Webhooks). This can lead to confidentiality loss where a regular (non-super) Zabbix administrator leaks data for hosts they do not have access to. A fix has been released that makes the built in Zabbix JavaScript objects read-only, but please be advised that usage of global JavaScript variables is not recommended because their content could be leaked. More information <a href='https://www.zabbix.com/documentation/7.4/en/manual/installation/known_issues#preprocessing-global-variables-are-unsafe'>in Zabbix documentation</a>.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
⚠️ Vulnerabilidades en productos Zabbix ❗ CVE-2026-23921 ❗ CVE-2026-23920 ❗ CVE-2026-23919 ➡️ Más info: https://www.cert.gov.py/vulnerabilidades-en-productos-zabbix/ https://t.co/qiJNKLih5o
Post summary
The post announces several CVE vulnerabilities in Zabbix products and links to additional information, but lacks technical details, exploitation evidence, or patch guidance.
[ZBX-27638] Insufficient isolation of JavaScript (Duktape) execution context on Zabbix Server (CVE-2026-23919) - ZABBIX SUPPORT https://support.zabbix.com/browse/ZBX-27638
Post summary
Zabbix’s support page announces an insufficient isolation flaw in its JavaScript execution environment (CVE‑2026‑23919) but provides no PoC, exploit, patch, or active exploitation details.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | zabbix | zabbix | - | - | - |