CVE-2026-23921 Blind, read-only SQL injection in Zabbix API via sortfield parameter
A low-privilege user can exploit blind SQL injection in the Zabbix API to exfiltrate database data and potentially compromise administrator accounts.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-23921?
CVE-2026-23921 is a high-severity SQL injection vulnerability in Zabbix Zabbix, published on 24 Mar 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A low privilege Zabbix user with API access can exploit a blind SQL injection vulnerability in include/classes/api/CApiService.php to execute arbitrary SQL selects via the sortfield parameter. Although query results are not returned directly, an attacker can exfiltrate arbitrary database data through time-based techniques, potentially leading to session identifier disclosure and administrator account compromise.
Weakness: CWE-89
Which versions are affected by CVE-2026-23921?
It affects 1 product.
Products include Zabbix Zabbix.
How do I fix CVE-2026-23921?
Apply the vendor's patch.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2026-23921 being exploited?
There is no known exploitation of CVE-2026-23921 in the wild and no public exploit code.
Public exploit code: 2 proofs of concept on GitHub.
Other vulnerabilities in Zabbix Zabbix
Sources
Also known as DEBIAN-CVE-2026-23921, GHSA-j24v-fg24-6mqq, UBUNTU-CVE-2026-23921.