Vulnerability · Published May 6, 2026 · Assigned by Zabbix
CVE-2026-23926Stored XSS vulnerability in Host navigator widget maintenance tooltip
High 7.3
In plain English
A high-severity cross-site scripting in Zabbix from Zabbix. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 18% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
An authenticated (non-super) administrator can create a maintenance period with a JavaScript payload that is executed by any user that opens tooltip for that maintenance period in the Host navigator widget. This can allow the attacker to perform unauthorized actions depending on which user opens the tooltip.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | zabbix | no fix listed | DEBIAN-CVE-2026-23926 |
| Debian:13 | zabbix | no fix listed | DEBIAN-CVE-2026-23926 |
| Debian:14 | zabbix | 1:7.0.27+dfsg-1 | DEBIAN-CVE-2026-23926 |
| Ubuntu:25.10 | zabbix | no fix listed | UBUNTU-CVE-2026-23926 |
| Ubuntu:26.04:LTS | zabbix | no fix listed | UBUNTU-CVE-2026-23926 |
| Ubuntu:26.10 | zabbix | no fix listed | UBUNTU-CVE-2026-23926 |
Affected products (as reported)
Weakness: CWE-79 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N