The JavaScript preprocessing (Duktape) engine on Zabbix server has a vulnerability where a limited administrator is able to read raw heap data… (CVE-2026-59782)

The JavaScript preprocessing engine (Duktape) in Zabbix server contains a vulnerability (CVE-2026-59782) where a limited administrator can read raw heap memory. This may result in exposure of data from other concurrently running preprocessors that are not accessible to that administrator. The vulnerability affects numerous specific versions of Zabbix server as listed. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required beyond limited administrator, no user interaction, and high impact on confidentiality. No vendor advisory or patch information is provided in the input data.

A limited administrator on the Zabbix server can read raw heap data, potentially exposing sensitive information from other preprocessors that should be inaccessible. This could lead to unauthorized data disclosure within the Zabbix environment. There is no indication of privilege escalation, denial of service, or integrity impact. No known exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict limited administrator access and monitor for unusual activity related to JavaScript preprocessing. Avoid granting unnecessary privileges to users with limited administrator roles.