Skip to content
CVE PROGRAM SOURCE RECORD6.9 Medium

CVE-2026-59786

Active agent heartbeat missing TLS check

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Zabbix

Description

Zabbix Server and Proxy accept the active agent heartbeat message regardless of the configured PSK or certificate authentication. This means someone with access to the Zabbix trapper port can report an arbitrary host using an active agent as available, resulting in a loss of integrity.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Zabbix Zabbix

Default version status: unknown

  • 7.0.0 to ≤ 7.0.28affected
  • 7.4.0 to ≤ 7.4.12affected

References