Zabbix SIA fixed multiple security vulnerabilities in the Zabbix monitoring software, including flaws in the API, Frontend, script item, preprocessing components, and the Windows Agent installer. The vulnerabilities correspond to several CWEs, including race conditions (CWE-362), exposure of sensitive information (CWE-522), improper access control (CWE-1321), use-after-free (CWE-405), information exposure through error messages (CWE-203), hard-coded passwords (CWE-259), out-of-bounds read (CWE-125), improper access control (CWE-248), and uncontrolled search path elements (CWE-427). The advisory from the Nationaal Cyber Security Centrum references 11 CVEs, including CVE-2026-1199 and others, but does not specify affected versions or CVSS scores. No known exploits in the wild have been reported.

The vulnerabilities could potentially allow unauthorized access, information disclosure, or other security issues in affected Zabbix components. However, without detailed impact descriptions or exploitation reports, the exact impact remains unspecified. No active exploitation is known at this time.

The vendor has released fixes addressing these vulnerabilities. Users should apply the official patches or updates provided by Zabbix SIA as indicated in the Nationaal Cyber Security Centrum advisory NCSC-2026-0320. Since no affected versions or patch links are explicitly stated, users should consult the vendor advisory directly for remediation details and ensure their Zabbix installations are updated accordingly.