CVE-2026-59781: Improper validation of custom installation directories on Windows could allow installation into locations with unsafe permissions, increasing the risk of DLL sideloading.
When Zabbix Agent was installed on Windows into a custom installation directory, the installer did not verify whether the selected directory had secure access permissions. If the target directory allowed unauthorized users to modify its contents, an attacker could place a malicious DLL that could later be loaded by the application, resulting in DLL sideloading. The installer has been hardened to detect potentially unsafe installation directories and now requires explicit user confirmation before proceeding with installation in such locations. This reduces the risk of accidental installation into directories with inappropriate permissions while preserving compatibility with existing deployment scenarios.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Update the Zabbix Agent Windows installer so that when a custom installation directory with potentially unsafe access permissions is selected, the installer detects it and requires explicit user confirmation before proceeding with installation.
Zabbix Agent (Windows installer) installer behavior for unsafe custom installation directories = require explicit user confirmation
Event History
Frequently Asked Questions
Which deployments are realistically at risk?
Windows deployments of Zabbix Agent that use a custom installation directory are exposed when unauthorized users can modify that directory's contents. Installations in directories with appropriately restricted permissions are not described as affected by this condition.
What access does an attacker need to exploit this issue?
An attacker needs the ability to write files into the Zabbix Agent installation directory, such as through unsafe directory permissions. They could then place a malicious DLL that the application later loads.
How does the hardened installer change installation behavior?
The installer now detects potentially unsafe custom installation directories and requires explicit user confirmation before continuing. This is intended to prevent accidental installation into locations with inappropriate permissions, while still allowing deployments that explicitly choose them.
What can be done if patching is not immediately possible?
Review the permissions on any custom Zabbix Agent installation directory and ensure unauthorized users cannot modify its contents. If the directory is writable by unauthorized users, treat it as unsafe because it could allow malicious DLL placement.