Vulnerability in Zabbix
CVE-2025-27237
In Zabbix Agent and Agent 2 on Windows, the OpenSSL configuration file is loaded from a path writable by low-privileged users, allowing malicious modification and potential local privilege escalation by injecting a DLL.
EPSS: 0.003 (24.9th percentile) — read the EPSS interpretation.
Affected products
- Zabbix — versions 6.0.0, 7.0.0, 7.2.0
Weakness classification (CWE)
Public proof-of-concept exploits
References
Frequently asked questions
- What is CVE-2025-27237?
- CVE-2025-27237 is a vulnerability in Zabbix, classified under Uncontrolled Search Path Element. Published 2025-10-03.
- Is CVE-2025-27237 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.