CVE-2026-23926 Stored XSS vulnerability in Host navigator widget maintenance tooltip
An authenticated administrator can inject JavaScript into maintenance tooltips, allowing execution against other users viewing the Host navigator widget.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-23926?
CVE-2026-23926 is a high-severity cross-site scripting vulnerability in Zabbix Zabbix, published on 6 May 2026. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
An authenticated (non-super) administrator can create a maintenance period with a JavaScript payload that is executed by any user that opens tooltip for that maintenance period in the Host navigator widget. This can allow the attacker to perform unauthorized actions depending on which user opens the tooltip.
Weakness: CWE-79
Which versions are affected by CVE-2026-23926?
It affects 1 product.
Products include Zabbix Zabbix.
How do I fix CVE-2026-23926?
Apply the vendor's patch.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-23926 being exploited?
There is no known exploitation of CVE-2026-23926 in the wild and no public exploit code.
Other vulnerabilities in Zabbix Zabbix
Sources
Also known as DEBIAN-CVE-2026-23926, GHSA-v7c2-5wfc-rfff, UBUNTU-CVE-2026-23926.