CVE-2026-23921

A low privilege Zabbix user with API access can exploit a blind SQL injection vulnerability in include/classes/api/CApiService.php to execute arbitrary SQL selects via the sortfield parameter. Although query results are not returned directly, an attacker can exfiltrate arbitrary database data through time-based techniques, potentially leading to session identifier disclosure and administrator account compromise.

Database specific

{
    "unresolved_ranges": [
        {
            "cpes": [
                "cpe:2.3:a:zabbix:zabbix:*:*:*:*:*:*:*:*"
            ],
            "extracted_events": [
                {
                    "introduced": "7.2.0"
                },
                {
                    "fixed": "7.2.15"
                }
            ],
            "source": "CPE_RANGE",
            "vendor_product": "zabbix:zabbix"
        }
    ]
}

References

https://support.zabbix.com/browse/ZBX-27640

Affected packages

Git / github.com/zabbix/zabbix

Affected ranges

Type

GIT

Repo

https://github.com/zabbix/zabbix

Events

Introduced

49955f1fb5c9168a8a24b053f7ade6b3d903143c

Fixed

ba52e2ee4ff8768c8450819a772886d79dcde0b4

Introduced

372a4e93c48ecd25aa666949a055a02369031861

Fixed

626d2b8a4820a424efe8fd39df3b706468f1e5d4

Database specific

Show details

{
    "cpe": "cpe:2.3:a:zabbix:zabbix:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "7.0.0"
        },
        {
            "fixed": "7.0.22"
        },
        {
            "introduced": "7.4.0"
        },
        {
            "fixed": "7.4.6"
        }
    ],
    "source": "CPE_RANGE"
}

Affected versions

7.*

7.0.0

7.0.1

7.0.10

7.0.10rc1

7.0.11

7.0.11rc1

7.0.11rc2

7.0.12

7.0.12rc1

7.0.13

7.0.13rc1

7.0.14

7.0.14rc1

7.0.15

7.0.16

7.0.17

7.0.17rc1

7.0.17rc2

7.0.18

7.0.18rc1

7.0.18rc2

7.0.19

7.0.19rc1

7.0.1rc1

7.0.1rc2

7.0.2

7.0.20

7.0.20rc1

7.0.21

7.0.22rc1

7.0.22rc2

7.0.22rc3

7.0.2rc1

7.0.2rc2

7.0.3

7.0.3rc1

7.0.4

7.0.4rc1

7.0.5

7.0.5rc1

7.0.6

7.0.6rc1

7.0.7

7.0.7rc1

7.0.8

7.0.8rc1

7.0.8rc2

7.0.9

7.0.9rc1

7.0.9rc2

7.4.0

7.4.1

7.4.1rc1

7.4.2

7.4.2rc1

7.4.2rc2

7.4.3

7.4.3rc1

7.4.4

7.4.4rc1

7.4.5

7.4.6rc1

7.4.6rc2

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-23921.json"

vanir_signatures

[
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "335575185657139336988338025089072345512",
                "144097728509264372924349761206701036791",
                "185724688006201679055704973376898360796",
                "130162026250320242787979560813111933511",
                "70354792077183199662061649065794713982",
                "152321436213664381476643075846246568564"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-23921-6d3c1d38",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/zabbix/zabbix/commit/626d2b8a4820a424efe8fd39df3b706468f1e5d4",
        "target": {
            "file": "src/zabbix_java/src/com/zabbix/gateway/GeneralInformation.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "335575185657139336988338025089072345512",
                "144097728509264372924349761206701036791",
                "265387215296323665047876836033014923187",
                "72110328909359773811350994976134420490",
                "245919019046659487345219626549275780890",
                "41189996272314509887159037345751552815"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-23921-8066b192",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/zabbix/zabbix/commit/ba52e2ee4ff8768c8450819a772886d79dcde0b4",
        "target": {
            "file": "src/zabbix_java/src/com/zabbix/gateway/GeneralInformation.java"
        }
    }
]

vanir_signatures_modified

"2026-09-12T08:14:50Z"