XSS in Zabbix

CVE-2026-23926

An authenticated (non-super) administrator can create a maintenance period with a JavaScript payload that is executed by any user that opens tooltip for that maintenance period in the Host navigator widget. This can allow the attacker to p…

Vulnerability class: XSS (Cross-Site Scripting)

EPSS: 0.001 (22.4th percentile) — read the EPSS interpretation.