CVE-2026-23921: Blind, read-only SQL injection in Zabbix API via sortfield parameter

Published Mar 24, 2026

Updated

A low privilege Zabbix user with API access can exploit a blind SQL injection vulnerability in include/classes/api/CApiService.php to execute arbitrary SQL selects via the sortfield parameter. Although query results are not returned directly, an attacker can exfiltrate arbitrary database data through time-based techniques, potentially leading to session identifier disclosure and administrator account compromise.

Affected Software

1 affected component

Zabbix Zabbix

Remediation

Information

Update the affected components to their respective fixed versions.

Event History

Mar 24, 2026

CVE Published

via MITRE·06:28 PM

Data Sourced

via MITRE·06:28 PM

RemedyDescriptionWeakness

Data Sourced

via NVD·07:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2026-23921?

CVE-2026-23921 is classified as a low severity vulnerability.

How do I fix CVE-2026-23921?

To fix CVE-2026-23921, update Zabbix to the latest version where this vulnerability has been addressed.

Who is affected by CVE-2026-23921?

CVE-2026-23921 affects Zabbix users with low privileges who have API access.

Can CVE-2026-23921 lead to data exposure?

CVE-2026-23921 can potentially allow exploitation of SQL queries, which may lead to unintended data exposure.

What components of Zabbix are impacted by CVE-2026-23921?

CVE-2026-23921 impacts the Zabbix API specifically via the sortfield parameter in the CApiService.php class.