CVE-2026-23933— Hardcoded session key in Zabbix 7.4
Possible ATT&CK Techniques 1AI
T1190 · Exploit Public-Facing ApplicationGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-23933
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Hardcoded session key in Zabbix 7.4
Source: CVE Program / CVE List V5
Vulnerability Description
In Zabbix 7.4 the cryptographic key used for signing Frontend sessions has been erroneously written to the database seed. Currently the only known exploitation scenario is for deployments that utilize both - SAML authentication and guest users. In such cases the key can be used to forge valid session cookies, potentially leading to unauthorized access. For other Zabbix deployments this does not have a known impact.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
使用硬编码的口令
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-23933
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-23933
请登录查看更多情报信息。
Other References for CVE-2026-23933 (1)
Same Patch Batch · Zabbix · 2026-08-18 · 11 CVEs total
| CVE-2026-23929 | 8.5 HIGH | Prototype pollution leading to stored XSS |
| CVE-2026-1199 | 6.9 MEDIUM | API and Frontend login lockout race condition |
| CVE-2026-23935 | 6.8 MEDIUM | Use-after-free read in script item/preprocessing HttpRequest body |
| CVE-2026-23937 | 6.0 MEDIUM | Host PSK extraction in Zabbix API |
| CVE-2026-59781 | 5.4 MEDIUM | Improper validation of custom installation directories on Windows could allow installation |
| CVE-2026-23931 | 5.3 MEDIUM | Frontend plaintext macro value enumeration via the validatate.api.exists action |
| CVE-2026-23930 | 5.3 MEDIUM | Frontend DoS via the popup.testtriggerexpr action |
| CVE-2026-23934 | 5.1 MEDIUM | Frontend DoS via the validate.api.exists action |
| CVE-2026-23938 | 2.1 LOW | Server DoS via JavaScript preprocessing or script items |
| CVE-2026-23922 | 2.1 LOW | Email media OAuth secret leak to Super Admin |
IV. Related Vulnerabilities
Same product: Zabbix
- CVE-2026-59781
Improper validation of custom installation directories on Wi - CVE-2026-23938
Server DoS via JavaScript preprocessing or script items - CVE-2026-23937
Host PSK extraction in Zabbix API - CVE-2026-23935
Use-after-free read in script item/preprocessing HttpRequest - CVE-2026-23934
Frontend DoS via the validate.api.exists action
Same vendor: Zabbix
- CVE-2026-59781
Improper validation of custom installation directories on Wi - CVE-2026-23938
Server DoS via JavaScript preprocessing or script items - CVE-2026-23937
Host PSK extraction in Zabbix API - CVE-2026-23935
Use-after-free read in script item/preprocessing HttpRequest - CVE-2026-23934
Frontend DoS via the validate.api.exists action
Same weakness: CWE-259
- CVE-2026-19750
Tenda CH/CP/TX3 SSH hard-coded password - CVE-2026-20316
Cisco Secure Firewall Management Center Software Static Cred - CVE-2026-11552
SourceCodester Onlne Examination & Learning Management Syste - CVE-2026-11515
SourceCodester Barangay Resident Profiling and Information M - CVE-2026-7251
Eppendorf BioFlo 320 Use of hard-coded password
V. Comments for CVE-2026-23933
No comments yet