Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-10-05T10:29:01 zabbix: zabbix: Host status spoofing via unauthenticated active agent heartbeats 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N CWE-306

Zabbix Server and Proxy accept the active agent heartbeat message regardless of the configured PSK or certificate authentication. This means someone with access to the Zabbix trapper port can report an arbitrary host using an active agent as available, resulting in a loss of integrity.

A flaw was found in Zabbix. A remote, unauthenticated attacker with network access to the trapper port can spoof host availability, compromising the integrity of monitoring data. The Zabbix server and proxy accept active agent heartbeat messages without verifying configured pre-shared key (PSK) or certificate-based authentication, allowing an attacker to falsely report arbitrary hosts as available.

Red Hat does not ship Zabbix in any supported product. The community EPEL zabbix7.0 package is affected by this flaw and a community tracker has been filed. Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. https://www.cve.org/CVERecord?id=CVE-2026-59786 https://nvd.nist.gov/vuln/detail/CVE-2026-59786 https://support.zabbix.com/browse/ZBX-28196