CVE-2026-23935 describes a vulnerability in Zabbix where an administrator can read out-of-bounds memory. The vulnerability affects numerous specific Ubuntu package versions of Zabbix, ranging from version 1:2.0.6+dfsg-1ubuntu2 through 1:7.0.22+dfsg-1. The CVSS 4.0 vector indicates the attack requires adjacent network access, low attack complexity, no privileges required beyond administrator level, no user interaction, and results in high confidentiality impact without affecting integrity or availability. No vendor advisory or patch information is provided, and no known exploits have been reported.

An attacker with administrator privileges on Zabbix can read memory outside the intended bounds, potentially exposing sensitive information. The impact is limited to confidentiality and does not affect integrity or availability. The vulnerability requires administrator privileges and adjacent network access, reducing the likelihood of remote exploitation by lower-privileged users.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, restrict administrator access to trusted personnel only and monitor for unusual activity. No official fix or workaround information is provided in the current data.