Zabbix 6.0.48, 7.0.29 and 7.4.13 fix a JavaScript preprocessing heap leak to limited admins (CVE-2026-59782, CVSS 4.0 6.9) and SNMP trap record injection in zabbix_trap_receiver.pl (CVE-2026-59787)

Zabbix, acting as its own CVE numbering authority, published two records on 5 October 2026 for Zabbix Server and Proxy. CVE-2026-59782 (ZBX-28193, CVSS 4.0 6.9 Medium): the Duktape JavaScript preprocessing engine lets a limited administrator read raw heap data, which can expose data from other running preprocessors that the administrator is not allowed to see. Zabbix credits Shaber Tseng via HackerOne. CVE-2026-59787 (ZBX-28197, Zabbix CVSS 4.0 5.3; Tenable's CVE page lists CVSS 3.1 9.1): the Perl SNMP trap receiver script shipped with Zabbix does not neutralise the ZBXTRAP record delimiter inside trap content, so anyone who can send SNMP traps to the receiver can inject a record that lands against a different monitored host. Zabbix credits the researcher 'stoun' via HackerOne. Both affect 6.0.0 to 6.0.47, 7.0.0 to 7.0.28 and 7.4.0 to 7.4.12. No exploitation has been reported.

Product

Zabbix Server and Zabbix Proxy (JavaScript preprocessing; zabbix_trap_receiver.pl SNMP trap receiver)

Versions

6.0.0–6.0.47, 7.0.0–7.0.28 and 7.4.0–7.4.12; fixed in 6.0.48, 7.0.29 and 7.4.13

CVSS

6.9 (CVE-2026-59782) and 5.3 (CVE-2026-59787), CVSS 4.0 from Zabbix; Tenable lists CVSS 3.1 9.1 for CVE-2026-59787

Exploited in Australia?

unknown

Patch to

Upgrade Zabbix Server and Proxy to 6.0.48, 7.0.29 or 7.4.13 or later. For CVE-2026-59787, also replace the deployed copy of zabbix_trap_receiver.pl with the fixed version (Zabbix says to do both), and only accept SNMP traps from known devices.

Primary: Zabbix — ZBX-28193 JavaScript preprocessing memory disclosure (CVE-2026-59782, 5 Oct 2026) · Vendor: Zabbix security advisories · CVE: CVE-2026-59782, CVE-2026-59787 · Zabbix — ZBX-28197 SNMP trap injection in zabbix_trap_receiver.pl (CVE-2026-59787, 5 Oct 2026)

vulnerabilities network