CVE-2026-23923

MediumCVSS 5.3/10Last modified Sep 10, 2026

Description

An unauthenticated attacker can exploit the Frontend 'validate' action to blindly instantiate arbitrary PHP classes. The impact depends on environment setup but appears limited at this time.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-470

Affected software

No affected versions have been published.

Timeline

Published
Mar 24, 2026
Last modified
Sep 10, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-239244.9Zabbix Agent 2 Docker plugin does not properly sanitize the 'docker.container_info' parameters when forwarding them to the Docker daemon. AnCVE-2026-239258.1An authenticated Zabbix user (User role) with template/host write permissions is able to create objects via the configuration.import API. ThCVE-2026-239266.8An authenticated (non-super) administrator can create a maintenance period with a JavaScript payload that is executed by any user that opensCVE-2026-239276.5A user able to connect to Agent 2 can inject an Oracle TNS connection string via the 'service' parameter. This can lead to Agent 2 connectinCVE-2026-239286.8The Item history widget (in Zabbix 7.0+) or the Plain text widget (in Zabbix 6.0) can execute injected JavaScript when HTML display is enablCVE-2026-239295.4Prototype pollution vulnerability in searchParamsToObject() is leading to a persistent XSS in Maps. URL parameter processing was not filteriCVE-2026-23937.1A Server-Side Request Forgery (SSRF) vulnerability exists in MLflow versions prior to 3.9.0. The `_create_webhook()` function in `mlflow/serCVE-2026-239307.5An unauthenticated user is able to cause disproportionate CPU load on the Frontend webserver by sending specifically crafted requests to theCVE-2026-239314.3The frontend validatate.api.exists action can be exploited by authenticated users to extract plaintext user macro values leading to potentiaCVE-2026-239339.1In Zabbix 7.4 the cryptographic key used for signing Frontend sessions has been erroneously written to the database seed. Currently the onlyCVE-2026-239346.5An authenticated user is able to cause disproportionate CPU load on the Frontend webserver by sending specifically crafted requests to the FCVE-2026-239354.9A Zabbix administrator is able to read out of bounds memory by utilizing a flaw in script item/preprocessing (JavaScript) HttpRequest logic,
CVE-2026-23923: Medium severity, CVSS 5.3 | Vulnix