VULNERABILITY INTELLIGENCE

CVE-2026-23921

CVSS score8.8 HIGH

EPSS probability4.10%

CISA KEVNot currently listed

Published2026-03-24

Last modified2026-09-10

Description

A low privilege Zabbix user with API access can exploit a blind SQL injection vulnerability in include/classes/api/CApiService.php to execute arbitrary SQL selects via the sortfield parameter. Although query results are not returned directly, an attacker can exfiltrate arbitrary database data through time-based techniques, potentially leading to session identifier disclosure and administrator account compromise.