CVE-2025-27240

Secondary-order SQL injection in Zabbix Server when deleting an autoregistered host

State: Published
Severity: 7.5 High
Published: Sep 12, 2025
Updated: Feb 26, 2026
Reserved: Feb 20, 2025

Description

A Zabbix adminitrator can inject arbitrary SQL during the autoremoval of hosts by inserting malicious SQL in the 'Visible name' field.

Scores

CVSS	Score	Vector	Source
4.0	7.5 High	CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N	Zabbix

Weaknesses

CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Affected Products

Product	Versions
ZabbixZabbix	6.0.0 through 6.0.33Affectedfrom 6.0.34Not affected 6.4.0 through 6.4.18Affectedfrom 6.4.19Not affected 7.0.0 through 7.0.3Affectedfrom 7.0.4Not affected

References

https://support.zabbix.com/browse/ZBX-26986

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.