According to its self-reported version number, the version of Zabbix running on the remote host is 6.0.x prior to 6.0.44, or 7.0.x prior to 7.0.23, or 7.2.x prior to 7.2.15, or 7.4.x prior to 7.4.7. It is, therefore, affected by multiple vulnerabilities :

- A blind, read-only SQL injection vulnerability in include/classes/api/CApiService.php, as a low privilege user with API access can execute arbitrary SQL selects via the sortfield parameter. Although query results are not returned directly, an attacker can exfiltrate arbitrary database data through time-based techniques, potentially leading to session identifier disclosure and administrator account compromise. (CVE-2026-23921)

- An OS command injection vulnerability, as host and event action script input is validated with an administrator-defined regex that runs in multiline mode. If the ^ and $ anchors are used, an injected newline lets authenticated users bypass the check and inject shell commands. (CVE-2026-23920)

- An insufficient isolation of the JavaScript (Duktape) execution context on the Zabbix server and proxy, as contexts used by script items, JavaScript preprocessing and webhooks are reused for performance reasons. This can lead to a confidentiality loss where a regular (non-super) administrator leaks data for hosts they do not have access to. (CVE-2026-23919)

- An unsafe reflection vulnerability, as an unauthenticated attacker can exploit the frontend 'validate' action to blindly instantiate arbitrary PHP classes. (CVE-2026-23923)

- An argument injection vulnerability in the Agent 2 Docker plugin, which does not properly sanitize the 'docker.container_info' parameters when forwarding them to the Docker daemon, allowing an attacker able to invoke Agent 2 to read arbitrary files from running Docker containers. (CVE-2026-23924)

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且供應商未提供可用的修補程式。

  - Zabbix Agent 2 Docker 外掛程式在將 'docker.container_info' 參數轉送至 Docker 程序時未正確清理這些參數。能夠叫用 Agent 2 的攻擊者可透過 Docker 封存 API 插入執行中的 Docker 容器讀取任意檔案。 (CVE-2026-23924)

請注意，Nessus 的判定取決於廠商所報告的套件是否存在。

Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - Zabbix Agent 2 Docker 插件在将“docker.container_info”参数转发到 Docker 后台程序时未正确审查这些参数。能够调用 Agent 2 的攻击者可通过 Docker 存档 API 注入文件从运行中的 Docker 容器中读取任意文件。 (CVE-2026-23924)

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - Zabbix Agent 2 Docker プラグインは「docker.container_info」パラメーターを Docker デーモンに転送する際に適切にサニタイズしません。Agent 2 を呼び出すことができる攻撃者が、Docker アーカイブ API を通じて任意のファイルを注入することで、実行中の Docker コンテナから任意のファイルを読み取ることができます。CVE-2026-23924

Nessus は、ベンダーによって報告されたパッケージの存在に依存していることに注意してください。

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Zabbix Agent 2 Docker plugin does not properly sanitize the 'docker.container_info' parameters when     forwarding them to the Docker daemon. An attacker capable of invoking Agent 2 can read arbitrary files     from running Docker containers by injecting them via the Docker archive API. (CVE-2026-23924)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
115514	Zabbix 6.0.x < 6.0.44 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	2026/9/23	2026/9/23	high
115517	Zabbix 7.4.x < 7.4.7 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	2026/9/23	2026/9/23	high
115516	Zabbix 7.2.x < 7.2.15 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	2026/9/23	2026/9/23	high
115515	Zabbix 7.0.x < 7.0.23 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	2026/9/23	2026/9/23	high
303995	Linux Distros 未修補的弱點：CVE-2026-23924	Nessus	Misc.	2026/3/27	2026/9/2	medium
303995	Linux Distros 未修补的漏洞：CVE-2026-23924	Nessus	Misc.	2026/3/27	2026/9/2	medium
303995	Linux Distros のパッチ未適用の脆弱性: CVE-2026-23924	Nessus	Misc.	2026/3/27	2026/9/2	medium
303995	Linux Distros Unpatched Vulnerability : CVE-2026-23924	Nessus	Misc.	2026/3/27	2026/9/2	medium

检测

插件搜索

high

high

high

high

medium

medium

medium

medium