CVE-2026-23927 — Agent 2 Oracle plugin TNS connection string injection via the 'service' parameter

CVE-2026-23927

Agent 2 Oracle plugin TNS connection string injection via the 'service' parameter PUBLISHED

Description (CNA)

A user able to connect to Agent 2 can inject an Oracle TNS connection string via the 'service' parameter. This can lead to Agent 2 connecting to an attacker-controlled server and leaking Oracle database credentials if they are saved in a named session.

Affected (CNA)

Vendor / product	Versions
Zabbix / Zabbix	affected 6.0.0 through 6.0.44; affected 7.0.0 through 7.0.23; affected 7.4.0 through 7.4.7

CWE

CWE-522

References

https://support.zabbix.com/browse/ZBX-27759

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.