1. Basic Information
- Article Title: Vulnerability in Zabbix agent installer regarding incorrect file access permissions
- Publisher: JVN
- Publication Date: 2026-08-28
- Original Source: JVN
- Related Information Sources: None
- Related Malware, Attack Groups, CVEs, and Products: CVE-2026-59781, Zabbix agent
- Severity: Medium
2. Summary
In Zabbix agent versions prior to 7.0.24 and 7.4.8, incorrect file access permissions during installation allow a local low-privileged attacker to load a malicious DLL and execute arbitrary code with administrator privileges.
3. Attack Flow
Attack Steps
- A low-privileged attacker places a malicious DLL in a location searched by the installer.
- An administrator runs the vulnerable installer.
- The installer loads the attacker's DLL.
- The DLL code runs with administrator privileges.
4. Attacker Position and Execution Location
- An attacker who has access to the target product and can exploit vulnerable features or improper permission boundaries.
- Operates under the application or escalated privileges after success.
5. Visibility for Victims and Administrators
Victims
- Hard to detect from on-screen signs alone, as it looks like normal operations or occurs without user interaction.
Administrators
- Events where the installer loads a DLL from a user-writable location.
- Suspicious child processes, services, tasks, or user creation originating from the installer.
- Outbound traffic to unknown destinations from endpoints immediately after an update.
6. Success and Failure Conditions
Success Conditions
- The attacker can write to the DLL search path.
- An administrator runs the vulnerable installer.
- The malicious DLL takes precedence over legitimate libraries.
Failure Conditions / Risk Mitigation
- Update to Zabbix agent 7.0.24, 7.4.8, or later.
- Run the installer from a dedicated directory writable only by administrators.
- Minimize ACLs on distribution shares and temporary directories.
7. What Happens Upon Success
- Privilege escalation from a low-privileged user to administrator privileges.
- Persistence, credential theft, and monitoring disruption on the monitored endpoint.
8. Observable Logs
- Email: None.
- Proxy/SWG/DNS: Events where the installer loads a DLL from a user-writable location.
- Endpoint/EDR: Suspicious child processes, services, tasks, or user creation originating from the installer.
- Identity/IdP: Outbound traffic to unknown destinations from endpoints immediately after an update.
- SaaS/Cloud: Check WAF, load balancers, and audit logs during cloud operations.
- Network: Check for outbound traffic to unknown destinations after success.
9. Attack Success Determination
- Attack Attempt Observed (Success Unconfirmed): Contact with the target is confirmed, but unauthorized operations or code execution are unconfirmed.
- User Action Confirmed: An administrator ran the vulnerable installer.
- Initial Execution Confirmed: Unauthorized responses, processing, or suspicious child processes are confirmed.
- Data Theft or Session Compromise Confirmed: Unauthorized information retrieval, credential access, or transmission is confirmed.
- Subsequent Compromise Confirmed: Additional payloads, persistence, tampering, deletion, or lateral movement is confirmed.
10. Investigation Playbook
- Trigger: Detection of Zabbix agent vulnerability exploitation or abnormal behavior.
- Initial Verification: Check version, exposure scope, patch status, initial anomaly time, and source. Preserve HTTP, application, and audit logs.
- Endpoint: Suspicious child processes, services, tasks, or user creation originating from the installer.
- Authentication & Cloud: Outbound traffic to unknown destinations from endpoints immediately after an update.
- Subsequent Operations: Investigate additional files, outbound traffic, credential access, and impact on other assets.
- Containment: Update to Zabbix agent 7.0.24, 7.4.8, or later. Run the installer from a dedicated directory writable only by administrators. Minimize ACLs on distribution shares and temporary directories. If a compromise is confirmed, isolate the target and revoke related credentials and sessions.
- Determination Categories: Distinguish between contact, prerequisites met, initial success, information compromise, and subsequent compromise.
11. Defense and Detection Ideas
- Single Event: Events where the installer loads a DLL from a user-writable location.
- Time-Series Correlation: External request or operation -> vulnerable feature -> privilege escalation from low-privileged user to administrator. Correlate with subsequent behavior.
- Threat Hunting: Events where the installer loads a DLL from a user-writable location. Suspicious child processes, services, tasks, or user creation originating from the installer. Outbound traffic to unknown destinations from endpoints immediately after an update.
- Log Gaps: Success stages cannot be determined if HTTP, application, process, identity, and network timestamps cannot be correlated.
- Priority Mitigations: Update to Zabbix agent 7.0.24, 7.4.8, or later. Run the installer from a dedicated directory writable only by administrators. Minimize ACLs on distribution shares and temporary directories.
12. Facts / Inference / Hypothesis
Facts
- Zabbix agent versions prior to 7.0.24 and 7.4.8 are affected.
- Incorrect file access permissions in the installer allow malicious DLLs to be executed with administrator privileges.
- CVSS v4.0 is 5.4, and CVSS v3.1 is 6.7, requiring local low privileges and user interaction.
- The vendor recommends updating to fixed versions.
Inference
- It is necessary to correlate requests, application processing, unauthorized operations, and subsequent behavior, rather than relying on individual IOCs alone.
Hypothesis
- The presence of actual exploitation or additional damage cannot be determined from public information alone.
13. MITRE ATT&CK Mapping
- T1574.002 Hijack Execution Flow: DLL Side-Loading (High): In Zabbix agent versions prior to 7.0.24 and 7.4.8, incorrect file access permissions during installation allow a local low-privileged attacker to load a malicious DLL and execute arbitrary code with administrator privileges.
- T1068 Exploitation for Privilege Escalation (High): In Zabbix agent versions prior to 7.0.24 and 7.4.8, incorrect file access permissions during installation allow a local low-privileged attacker to load a malicious DLL and execute arbitrary code with administrator privileges.
14. Unknowns and Additional Investigation
- Exact DLL names and search order during exploitation.
- Presence of actual exploitation cases and public PoCs.
15. Impact on SOCs
Zabbix is widely used across organizations. Verify Windows agent versions, distribution shares, and execution directory ACLs, and monitor DLL loading during updates.
16. Summary by Target Audience
- For SOCs: Review time-series data for events where the installer loads a DLL from a user-writable location; suspicious child processes, services, tasks, or user creation originating from the installer; and outbound traffic to unknown destinations from endpoints immediately after an update.
- For Administrators: Update to Zabbix agent 7.0.24, 7.4.8, or later. Run the installer from a dedicated directory writable only by administrators. Minimize ACLs on distribution shares and temporary directories.
- For Users: Report any unrecognized changes or service anomalies to the management department.
