CVE-2026-23923 - Unauthenticated arbitrary PHP class instantiation

Back Back to CVE browser

MEDIUM

Unauthenticated arbitrary PHP class instantiation

Published Mar 24, 2026

6.9

MEDIUM

CVSS 4.0

EPSS 0.27%

Description

An unauthenticated attacker can exploit the Frontend 'validate' action to blindly instantiate arbitrary PHP classes. The impact depends on environment setup but appears limited at this time.

Affected products

Vendor Zabbix Product Zabbix Default
n/a
- Version
  7.4.0
  Status
  affected
  Constraints
  <=7.4.6

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Zabbix

n/a

Version	Status	Constraints
7.4.0	affected	<=7.4.6

Remediation

Vendor solution

Update the affected components to their respective fixed versions.

Weaknesses (1)

CWE-470

References (1)

https://support.zabbix.com/browse/ZBX-27641
Vendor Advisory

Link	Providers	Tags
https://support.zabbix.com/browse/ZBX-27641		Vendor Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner Zabbix

Published Mar 24, 2026

Updated Mar 25, 2026

Reserved Jan 19, 2026

Link CVE-2026-23923

CISA Vulnrichment

Updated Mar 25, 2026

NVD

Status Analyzed

Modified Sep 10, 2026

Link CVE-2026-23923

Red Hat

Severity n/a

Public date n/a

Links CVE-2026-23923