CVE-2026-59781 Other in Zabbix

What is CVE-2026-59781?

CVE-2026-59781 is a medium-severity vulnerability in Zabbix Zabbix, published on 18 Aug 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

When Zabbix Agent was installed on Windows into a custom installation directory, the installer did not verify whether the selected directory had secure access permissions. If the target directory allowed unauthorized users to modify its contents, an attacker could place a malicious DLL that could later be loaded by the application, resulting in DLL sideloading. The installer has been hardened to detect potentially unsafe installation directories and now requires explicit user confirmation before proceeding with installation in such locations. This reduces the risk of accidental installation into directories with inappropriate permissions while preserving compatibility with existing deployment scenarios.

Weakness: CWE-427

Which versions are affected by CVE-2026-59781?

It affects 1 product.

Products include Zabbix Zabbix.

How do I fix CVE-2026-59781?

No fix has been published for CVE-2026-59781 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-59781 being exploited?

There is no known exploitation of CVE-2026-59781 in the wild and no public exploit code.

Other vulnerabilities in Zabbix Zabbix

• CVE-2022-23131 Zabbix Frontend Authentication Bypass Exploited Critical 9.1
• CVE-2007-0640 Memory corruption in n/a Critical 10.0
• CVE-2024-42327 SQL injection in user.get API Critical 9.9
• CVE-2024-22116 Remote code execution within ping script Critical 9.9
• CVE-2013-3738 Code injection in n/a Critical 9.8

All Zabbix Zabbix vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-734c-5898-qrph, UBUNTU-CVE-2026-59781.