CVE-2026-1199

6.9 mediumEPSS 0.2%

Medium (6.9) in zabbix zabbix. EPSS 0.2% chance of exploitation in the next 30 days.

Zabbix API and Frontend login lockout mechanism has a flaw where several unsuccessful login requests are not properly counted towards the block counter if sent simultaneously, potentially allowing for more password guesses than intended.

Severity

CVSS 4.0

6.9 medium

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

CVSS 3.1

3.7 low

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

EPSS: 0.2% chance of exploitation in the next 30 days; higher than 13% of CVEs (scores of 2026-10-31)
CWE: CWE-362
Published: 2026-08-18
Modified: 2026-09-08
Record from: the NVD, synced 2026-10-19

Affected

zabbix:zabbix

References

https://support.zabbix.com/browse/ZBX-28076

Check your stack JSON