Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Host and event action script input is validated with a regex (set by the administrator), but the validation runs in multiline mode. If ^ and $ anchors are used in user input validation, an injected newline lets authenticated users bypass the check and inject shell commands.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-03-27 | 1 | Disclosure1 |
| 2026-03-30 | 1 | General1 |
⚠️ Vulnerabilidades en productos Zabbix ❗ CVE-2026-23921 ❗ CVE-2026-23920 ❗ CVE-2026-23919 ➡️ Más info: https://www.cert.gov.py/vulnerabilidades-en-productos-zabbix/ https://t.co/qiJNKLih5o
Post summary
The message lists three Zabbix-related CVEs and provides a link for more information, but does not include any PoC, exploit details, patch info, or technical specifics.
[ZBX-27639] Host and event action script regex validation can be bypassed in certain situations, leading to potential command injection (CVE-2026-23920) - ZABBIX SUPPORT https://support.zabbix.com/browse/ZBX-27639
Post summary
Zabbix support documents a regex validation bypass that enables command injection in host/event action scripts, identifying CVE-2026-23920.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | zabbix | zabbix | - | - | - |