Skip to content
CVE PROGRAM SOURCE RECORD5.1 Medium

CVE-2026-23927

Agent 2 Oracle plugin TNS connection string injection via the 'service' parameter

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Zabbix

Description

A user able to connect to Agent 2 can inject an Oracle TNS connection string via the 'service' parameter. This can lead to Agent 2 connecting to an attacker-controlled server and leaking Oracle database credentials if they are saved in a named session.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Zabbix Zabbix

Default version status: unknown

  • 6.0.0 to ≤ 6.0.44affected
  • 7.0.0 to ≤ 7.0.23affected
  • 7.4.0 to ≤ 7.4.7affected

References