CVE-2026-59787

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-59787", "assignerOrgId": "72de3e22-0555-4a0d-ae81-9249e0f0a1e8", "state": "PUBLISHED", "assignerShortName": "Zabbix", "dateReserved": "2026-07-07T08:30:49.860Z", "datePublished": "2026-10-05T10:29:20.302Z", "dateUpdated": "2026-10-05T11:23:32.622Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "72de3e22-0555-4a0d-ae81-9249e0f0a1e8", "shortName": "Zabbix", "dateUpdated": "2026-10-05T10:29:20.302Z"}, "title": "SNMP trap injection in zabbix_trap_receiver.pl", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-143", "description": "CWE-143: Improper Neutralization of Record Delimiters", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-153", "descriptions": [{"lang": "en", "value": "CAPEC-153: Input Data Manipulation"}]}], "affected": [{"vendor": "Zabbix", "product": "Zabbix", "repo": "https://git.zabbix.com/", "modules": ["Server", "Proxy"], "versions": [{"status": "affected", "version": "6.0.0", "lessThanOrEqual": "6.0.47", "changes": [{"at": "6.0.48", "status": "unaffected"}], "versionType": "git"}, {"status": "affected", "version": "7.0.0", "lessThanOrEqual": "7.0.28", "changes": [{"at": "7.0.29", "status": "unaffected"}], "versionType": "git"}, {"status": "affected", "version": "7.4.0", "lessThanOrEqual": "7.4.12", "changes": [{"at": "7.4.13", "status": "unaffected"}], "versionType": "git"}], "defaultStatus": "unknown"}], "descriptions": [{"lang": "en", "value": "The Perl SNMP trap receiver script shipped with Zabbix does not properly neutralize the ZBXTRAP record delimiter in trap content. This means someone able to send SNMP traps can inject a record targeting another host, resulting in a loss of integrity.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>The Perl SNMP trap receiver script shipped with Zabbix does not properly neutralize the ZBXTRAP record delimiter in trap content. This means someone able to send SNMP traps can inject a record targeting another host, resulting in a loss of integrity.</p>"}]}], "references": [{"url": "https://support.zabbix.com/browse/ZBX-28197"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "MEDIUM", "baseScore": 5.3, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N"}}], "configurations": [{"lang": "en", "value": "Attacker sending crafted SNMP trap payloads to the trap receiver.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>Attacker sending crafted SNMP trap payloads to the trap receiver.</p>"}]}], "solutions": [{"lang": "en", "value": "Update the affected components and replace the deployed zabbix_trap_receiver.pl with the fixed version.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>Update the affected components and replace the deployed zabbix_trap_receiver.pl with the fixed version.</p>"}]}], "credits": [{"lang": "en", "value": "Zabbix wants to thank stoun for submitting this report on the HackerOne bug bounty platform.", "type": "reporter"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 1.0.5"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-05T11:23:21.868482Z", "id": "CVE-2026-59787", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-05T11:23:32.622Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-59787", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-05T11:23:21.868482Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-05T11:23:25.878Z"}}], "cna": {"title": "SNMP trap injection in zabbix_trap_receiver.pl", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "reporter", "value": "Zabbix wants to thank stoun for submitting this report on the HackerOne bug bounty platform."}], "impacts": [{"capecId": "CAPEC-153", "descriptions": [{"lang": "en", "value": "CAPEC-153: Input Data Manipulation"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://git.zabbix.com/", "vendor": "Zabbix", "modules": ["Server", "Proxy"], "product": "Zabbix", "versions": [{"status": "affected", "changes": [{"at": "6.0.48", "status": "unaffected"}], "version": "6.0.0", "versionType": "git", "lessThanOrEqual": "6.0.47"}, {"status": "affected", "changes": [{"at": "7.0.29", "status": "unaffected"}], "version": "7.0.0", "versionType": "git", "lessThanOrEqual": "7.0.28"}, {"status": "affected", "changes": [{"at": "7.4.13", "status": "unaffected"}], "version": "7.4.0", "versionType": "git", "lessThanOrEqual": "7.4.12"}], "defaultStatus": "unknown"}], "solutions": [{"lang": "en", "value": "Update the affected components and replace the deployed zabbix_trap_receiver.pl with the fixed version.", "supportingMedia": [{"type": "text/html", "value": "<p>Update the affected components and replace the deployed zabbix_trap_receiver.pl with the fixed version.</p>", "base64": false}]}], "references": [{"url": "https://support.zabbix.com/browse/ZBX-28197"}], "x_generator": {"engine": "Vulnogram 1.0.5"}, "descriptions": [{"lang": "en", "value": "The Perl SNMP trap receiver script shipped with Zabbix does not properly neutralize the ZBXTRAP record delimiter in trap content. This means someone able to send SNMP traps can inject a record targeting another host, resulting in a loss of integrity.", "supportingMedia": [{"type": "text/html", "value": "<p>The Perl SNMP trap receiver script shipped with Zabbix does not properly neutralize the ZBXTRAP record delimiter in trap content. This means someone able to send SNMP traps can inject a record targeting another host, resulting in a loss of integrity.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-143", "description": "CWE-143: Improper Neutralization of Record Delimiters"}]}], "configurations": [{"lang": "en", "value": "Attacker sending crafted SNMP trap payloads to the trap receiver.", "supportingMedia": [{"type": "text/html", "value": "<p>Attacker sending crafted SNMP trap payloads to the trap receiver.</p>", "base64": false}]}], "providerMetadata": {"orgId": "72de3e22-0555-4a0d-ae81-9249e0f0a1e8", "shortName": "Zabbix", "dateUpdated": "2026-10-05T10:29:20.302Z"}}}, "cveMetadata": {"cveId": "CVE-2026-59787", "state": "PUBLISHED", "dateUpdated": "2026-10-05T11:23:32.622Z", "dateReserved": "2026-07-07T08:30:49.860Z", "assignerOrgId": "72de3e22-0555-4a0d-ae81-9249e0f0a1e8", "datePublished": "2026-10-05T10:29:20.302Z", "assignerShortName": "Zabbix"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unknown", "modules": ["Server", "Proxy"], "product": "Zabbix", "repo": "https://git.zabbix.com/", "vendor": "Zabbix", "versions": [{"changes": [{"at": "6.0.48", "status": "unaffected"}], "lessThanOrEqual": "6.0.47", "status": "affected", "version": "6.0.0", "versionType": "git"}, {"changes": [{"at": "7.0.29", "status": "unaffected"}], "lessThanOrEqual": "7.0.28", "status": "affected", "version": "7.0.0", "versionType": "git"}, {"changes": [{"at": "7.4.13", "status": "unaffected"}], "lessThanOrEqual": "7.4.12", "status": "affected", "version": "7.4.0", "versionType": "git"}]}], "source": "security@zabbix.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Perl SNMP trap receiver script shipped with Zabbix does not properly neutralize the ZBXTRAP record delimiter in trap content. This means someone able to send SNMP traps can inject a record targeting another host, resulting in a loss of integrity."}], "id": "CVE-2026-59787", "lastModified": "2026-10-06T15:27:05.657", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security@zabbix.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-59787", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-05T11:23:21.868482Z", "version": "2.0.3"}}]}, "published": "2026-10-05T11:16:59.953", "references": [{"source": "security@zabbix.com", "url": "https://support.zabbix.com/browse/ZBX-28197"}], "sourceIdentifier": "security@zabbix.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-143"}], "source": "security@zabbix.com", "type": "Secondary"}]}

{"bugzilla": {"description": "zabbix: zabbix: Trap record injection via unsanitized delimiter in SNMP trap receiver", "id": "2545867", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2545867"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.3", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "status": "draft"}, "cwe": "CWE-140", "details": ["A flaw was found in Zabbix. The Perl Simple Network Management Protocol (SNMP) trap receiver script does not properly sanitize the record delimiter within incoming trap content. An attacker capable of sending SNMP traps can exploit this vulnerability to inject forged trap records targeting other monitored hosts, leading to unauthorized data modification and a loss of monitoring data integrity."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-59787", "public_date": "2026-10-05T10:29:20Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-59787\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-59787\nhttps://support.zabbix.com/browse/ZBX-28197"], "statement": "Red Hat does not ship Zabbix in any supported product. The community Fedora and EPEL packages are affected by this flaw and community trackers have been filed.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.0.0,6.0.47]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[7.0.0,7.0.28]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[7.4.0,7.4.12]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Zabbix", "source": "cna", "vendor": "Zabbix"}, "product": "zabbix", "vendor": "zabbix"}], "created": "2026-10-05T11:30:17.483070+00:00", "updated": "2026-10-07T07:15:08.632514+00:00", "vendors": ["zabbix", "zabbix$PRODUCT$zabbix"]}