CVE-2026-23926: Stored XSS vulnerability in Host navigator widget maintenance tooltip

Q: What is the severity of CVE-2026-23926?

The severity of CVE-2026-23926 is high, rated at 7.3 on the CVSS scale.

Q: How do I fix CVE-2026-23926?

To fix CVE-2026-23926, you should update the affected components to their respective fixed versions.

Q: What type of vulnerability is CVE-2026-23926?

CVE-2026-23926 is a stored XSS (Cross-Site Scripting) vulnerability.

Q: Who is impacted by CVE-2026-23926?

CVE-2026-23926 impacts authenticated non-super administrators and any users who open the tooltip.

Q: Can CVE-2026-23926 allow attackers to perform unauthorized actions?

Yes, CVE-2026-23926 can allow attackers to perform unauthorized actions depending on the user's role and permissions.

Published May 6, 2026

Updated

An authenticated (non-super) administrator can create a maintenance period with a JavaScript payload that is executed by any user that opens tooltip for that maintenance period in the Host navigator widget. This can allow the attacker to perform unauthorized actions depending on which user opens the tooltip.

Affected Software

2 affected components

Zabbix Zabbix>=7.0.0<7.0.24

Zabbix Zabbix>=7.4.0<7.4.8

Event History

May 6, 2026

CVE Published

via MITRE·06:58 AM

Data Sourced

via MITRE·06:58 AM

RemedyDescriptionWeakness

Data Sourced

via NVD·08:16 AM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2026-23926?

The severity of CVE-2026-23926 is high, rated at 7.3 on the CVSS scale.

How do I fix CVE-2026-23926?

To fix CVE-2026-23926, you should update the affected components to their respective fixed versions.

What type of vulnerability is CVE-2026-23926?