CVE-2026-23923

MEDIUM

Unauthenticated arbitrary PHP class instantiation

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2026-23923 has a selected CVSS score of 6.9 (medium).

Description

An unauthenticated attacker can exploit the Frontend 'validate' action to blindly instantiate arbitrary PHP classes. The impact depends on environment setup but appears limited at this time.

Description source: CVE List

Exploitation context

CISA SSVC decision

ExploitationNone
AutomatableYes
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Mar 25, 2026 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

Zabbix

Browse Zabbix / Zabbix

Default status: unknown

CVE List7.4.0 to ≤ 7.4.6affected

References

2