CVE-2026-23927
A user able to connect to Agent 2 can inject an Oracle TNS connection string via the 'service' parameter.
Published May 6, 2026 · updated Sep 18, 2026 · zabbix zabbix
A user able to connect to Agent 2 can inject an Oracle TNS connection string via the 'service' parameter. This can lead to Agent 2 connecting to an attacker-controlled server and leaking Oracle database credentials if they are saved in a named session.
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
May 6, 2026 · NIST NVD
Detected
A user able to connect to Agent 2 can inject an Oracle TNS connection string via the 'service' parameter. This can lead to Agent 2 connecting to an attacker-controlled server and leaking Oracle database credentials if they are saved in a named session.
Sep 18, 2026 · NIST NVD
Updated
A user able to connect to Agent 2 can inject an Oracle TNS connection string via the 'service' parameter. This can lead to Agent 2 connecting to an attacker-controlled server and leaking Oracle database credentials if they are saved in a named session.
Affected
- cpe zabbix/zabbixversion unspecified
Sources
- CVE.orgVulnerability recordCVE-2026-23927
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-23927
A user able to connect to Agent 2 can inject an Oracle TNS connection string via the 'service' parameter. This can lead to Agent 2 connecting to an attacker-controlled server and leaking Oracle database credentials if they are saved in a named session.
nvd.nist.gov