CVE-2026-23920

Zabbix can use rules to check information before running an action script. In certain configurations, a logged-in user can add a hidden line break that slips past that check and adds an unwanted command—like getting a forged extra instruction accepted with an otherwise valid work order.

This matters to you if you run Zabbix, including a Zabbix package supplied by ALT Linux, Debian, or Red OS. Review systems where staff or service accounts can create, edit, or trigger host or event action scripts; the issue requires an attacker to already have a login.

There is no record of active exploitation or public exploit code, so this is an amber-priority maintenance issue rather than an emergency incident. Address it promptly because a compromised or overly privileged Zabbix account could use the bypass to execute commands on the Zabbix server.

Confirm whether the deployed Zabbix version has received the vendor fix and inspect host and event action scripts for administrator-defined regex validation using ^ and $. Upgrade Zabbix to 7.0.22; for ALT Linux, Debian, and Red OS, obtain the respective vendor-maintained package update because no fixed distribution package versions are provided here.

If patching must wait, change affected validation expressions to use \A and \z anchors instead of ^ and $, then test the action workflow before relying on it. Restrict permissions to configure or trigger action scripts, and review Zabbix audit records and server command activity for unexpected script changes, unusual newline-containing input, or unfamiliar commands. This CVE is not in CISA KEV, so no CISA remediation due date applies.

CVE-2026-23920 is CWE-78 command injection, rated CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The vulnerable validation runs regexes in multiline mode, allowing newline-based bypasses of ^ and $ anchors in host and event action script input validation. Exploitation requires privileges (PR:L); no public exploit code is on record and CISA KEV does not list the CVE. EPSS is 0.3% (23rd percentile) with a flat trend; this is predicted likelihood, not evidence of exploitation. Press attention is rising.