CVE-2026-23923

Unauthenticated arbitrary PHP class instantiation PUBLISHED

Description (CNA)

An unauthenticated attacker can exploit the Frontend 'validate' action to blindly instantiate arbitrary PHP classes. The impact depends on environment setup but appears limited at this time.

Affected (CNA)

Vendor / product	Versions
Zabbix / Zabbix	affected 7.4.0 through 7.4.6

CWE

CWE-470

References

https://support.zabbix.com/browse/ZBX-27641

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.