What is CVE-2026-23921?

CVE-2026-23921 is a vulnerability in Zabbix, classified under SQL Injection. Published 2026-03-24.

Is CVE-2026-23921 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

SQL Injection in Zabbix

CVE-2026-23921

A low privilege Zabbix user with API access can exploit a blind SQL injection vulnerability in include/classes/api/CApiService.php to execute arbitrary SQL selects via the sortfield parameter. Although query results are not returned directly, an attacker can exfiltrate arbitrary database data through time-based techniques, potentially leading to session identifier disclosure and administrator account compromise.

Vulnerability class: SQL Injection

EPSS: 0.002 (15.3th percentile) — read the EPSS interpretation.

Affected products

Zabbix — versions 7.0.0, 7.2.0, 7.4.0

Weakness classification (CWE)

CWE-89 — SQL Injection

Public proof-of-concept exploits

RichJJ98/analise-vulnerabilidades-zabbix-notebooklm

References

security@zabbix.com

Frequently asked questions

What is CVE-2026-23921?: CVE-2026-23921 is a vulnerability in Zabbix, classified under SQL Injection. Published 2026-03-24.
Is CVE-2026-23921 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.