CVE-2026-23920: Host and event action script regex validation can be bypassed in certain situations, leading to potential command injection

Published Mar 24, 2026
·
Updated

Host and event action script input is validated with a regex (set by the administrator), but the validation runs in multiline mode. If ^ and $ anchors are used in user input validation, an injected newline lets authenticated users bypass the check and inject shell commands.

Affected Software

3 affected components
Zabbix Zabbix>=7.0.0<7.0.22
Zabbix Zabbix>=7.2.0<7.2.15
Zabbix Zabbix>=7.4.0<7.4.6

Event History

Mar 24, 2026
CVE Published
via MITRE·06:27 PM
Data Sourced
via MITRE·06:27 PM
RemedyDescriptionWeakness
Data Sourced
via NVD·07:16 PM
DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

1

What is the severity of CVE-2026-23920?

CVE-2026-23920 has a severity rating of high, specifically scoring 7.7 on the CVSS scale.

2

What is CVE-2026-23920 about?

CVE-2026-23920 describes a vulnerability where regex validation for host and event action scripts can be bypassed, potentially allowing command injection.

3

Who is affected by CVE-2026-23920?

Authenticated users of systems utilizing vulnerable versions for host and event action script validation are at risk from CVE-2026-23920.

4

How do I fix CVE-2026-23920?

To resolve CVE-2026-23920, update the affected components to their respective fixed versions as released by the vendor.

5

What type of attack does CVE-2026-23920 enable?

CVE-2026-23920 enables OS Command Injection attacks by allowing bypass of input validation through injected newlines.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203