CVE-2026-59781

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-59781

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-59781.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-59781

Downstream

UBUNTU-CVE-2026-59781

Published

2026-08-18T13:17:25Z

Modified

2026-09-25T08:27:32Z

Severity

7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVSS Calculator

Summary

[none]

Details

When Zabbix Agent was installed on Windows into a custom installation directory, the installer did not verify whether the selected directory had secure access permissions. If the target directory allowed unauthorized users to modify its contents, an attacker could place a malicious DLL that could later be loaded by the application, resulting in DLL sideloading. The installer has been hardened to detect potentially unsafe installation directories and now requires explicit user confirmation before proceeding with installation in such locations. This reduces the risk of accidental installation into directories with inappropriate permissions while preserving compatibility with existing deployment scenarios.

References

https://support.zabbix.com/browse/ZBX-28077

Affected packages

Git / github.com/zabbix/zabbix

Affected ranges

Type

GIT

Repo

https://github.com/zabbix/zabbix

Events

Introduced

5203d2ea7d901cd33d148f20586e2155901a7faa

Fixed

6be78c5969e30b7766721926eb0981dafd96bc7a

Introduced

49955f1fb5c9168a8a24b053f7ade6b3d903143c

Fixed

db132c325e99abe8e13c9935d3558f6e26376623

Introduced

372a4e93c48ecd25aa666949a055a02369031861

Fixed

3c95000629791258a59622e3e4e995df45c44453

Database specific

Show details

{
    "cpe":  "cpe:2.3:a:zabbix:zabbix:*:*:*:*:*:*:*:*",
    "extracted_events":  [
        {
            "introduced":  "6.0.0"
        },
        {
            "fixed":  "6.0.48"
        },
        {
            "introduced":  "7.0.0"
        },
        {
            "fixed":  "7.0.29"
        },
        {
            "introduced":  "7.4.0"
        },
        {
            "fixed":  "7.4.13"
        }
    ],
    "source":  "CPE_RANGE"
}

Affected versions

6.*

6.0.0

6.0.1

6.0.10

6.0.10rc1

6.0.10rc2

6.0.11

6.0.11rc1

6.0.11rc2

6.0.12

6.0.12rc1

6.0.12rc2

6.0.13

6.0.13rc1

6.0.14

6.0.14rc1

6.0.14rc2

6.0.15

6.0.15rc1

6.0.15rc2

6.0.16

6.0.16rc1

6.0.17

6.0.17rc1

6.0.17rc2

6.0.18

6.0.18rc1

6.0.19

6.0.19rc1

6.0.1rc1

6.0.1rc2

6.0.1rc3

6.0.1rc4

6.0.2

6.0.20

6.0.20rc1

6.0.21

6.0.21rc1

6.0.22

6.0.22rc1

6.0.23

6.0.23rc1

6.0.25

6.0.25rc1

6.0.26

6.0.26rc1

6.0.27

6.0.27rc1

6.0.28

6.0.28rc1

6.0.29

6.0.29rc1

6.0.2rc1

6.0.3

6.0.30

6.0.30rc1

6.0.31

6.0.31rc1

6.0.32

6.0.32rc1

6.0.33

6.0.33rc1

6.0.34

6.0.34rc1

6.0.34rc2

6.0.35

6.0.35rc1

6.0.36

6.0.36rc1

6.0.37

6.0.37rc1

6.0.38

6.0.38rc1

6.0.39

6.0.39rc1

6.0.3rc1

6.0.4

6.0.40

6.0.40rc1

6.0.41

6.0.41rc1

6.0.42

6.0.42rc1

6.0.43

6.0.43rc1

6.0.44

6.0.44rc1

6.0.45

6.0.45rc1

6.0.46

6.0.46rc1

6.0.47

6.0.47rc1

6.0.48rc1

6.0.4rc1

6.0.5

6.0.5rc1

6.0.6

6.0.6rc1

6.0.7

6.0.7rc1

6.0.8

6.0.8rc1

6.0.8rc2

6.0.9

6.0.9rc1

6.0.9rc2

7.*

7.0.0

7.0.1

7.0.10

7.0.10rc1

7.0.11

7.0.11rc1

7.0.11rc2

7.0.12

7.0.12rc1

7.0.13

7.0.13rc1

7.0.14

7.0.14rc1

7.0.15

7.0.16

7.0.17

7.0.17rc1

7.0.17rc2

7.0.18

7.0.18rc1

7.0.18rc2

7.0.19

7.0.19rc1

7.0.1rc1

7.0.1rc2

7.0.2

7.0.20

7.0.20rc1

7.0.21

7.0.22

7.0.22rc1

7.0.22rc2

7.0.22rc3

7.0.23

7.0.23rc1

7.0.23rc2

7.0.24

7.0.24rc1

7.0.24rc2

7.0.24rc3

7.0.25

7.0.25rc1

7.0.26

7.0.26rc1

7.0.27

7.0.27rc1

7.0.28

7.0.28rc1

7.0.29rc1

7.0.2rc1

7.0.2rc2

7.0.3

7.0.3rc1

7.0.4

7.0.4rc1

7.0.5

7.0.5rc1

7.0.6

7.0.6rc1

7.0.7

7.0.7rc1

7.0.8

7.0.8rc1

7.0.8rc2

7.0.9

7.0.9rc1

7.0.9rc2

7.4.0

7.4.1

7.4.10

7.4.10rc1

7.4.11

7.4.11rc1

7.4.11rc2

7.4.12

7.4.12rc1

7.4.13rc1

7.4.1rc1

7.4.2

7.4.2rc1

7.4.2rc2

7.4.3

7.4.3rc1

7.4.4

7.4.4rc1

7.4.5

7.4.6

7.4.6rc1

7.4.6rc2

7.4.7

7.4.7rc1

7.4.7rc2

7.4.7rc3

7.4.8

7.4.8rc1

7.4.8rc2

7.4.8rc3

7.4.9

7.4.9rc1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-59781.json"

vanir_signatures

[
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "38474942724400755040639656600916123909",
                "262671518745552141070108653118255299812",
                "121905655504638774963629163364407679001",
                "2016342183407537024331254307804687860",
                "305961410076677336229698126394298764757",
                "36895359277520185036891477870599919643"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-59781-50f2faa7",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/zabbix/zabbix/commit/db132c325e99abe8e13c9935d3558f6e26376623",
        "target":  {
            "file":  "src/zabbix_java/src/com/zabbix/gateway/GeneralInformation.java"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "93487397254500518766622927375894284342",
                "74403242043917662532779159626289586182",
                "319774669758399858809487861530721115375",
                "34245541773008437135188343313147378501",
                "181086764401691885195685192858848704657",
                "165838044632546050705702632931399174307"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-59781-580da33b",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/zabbix/zabbix/commit/3c95000629791258a59622e3e4e995df45c44453",
        "target":  {
            "file":  "src/zabbix_java/src/com/zabbix/gateway/GeneralInformation.java"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "38474942724400755040639656600916123909",
                "262671518745552141070108653118255299812",
                "218132111999975809389027274173580059057",
                "7454492471626951400546400122388203937",
                "112118943216507164326229728890314673926",
                "91154863352484394813335040509744619190"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-59781-b00929e9",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/zabbix/zabbix/commit/6be78c5969e30b7766721926eb0981dafd96bc7a",
        "target":  {
            "file":  "src/zabbix_java/src/com/zabbix/gateway/GeneralInformation.java"
        }
    }
]

vanir_signatures_modified

"2026-09-25T08:27:32Z"