Answer Brief
JVN#42011956 reports a DLL loading vulnerability, CVE-2026-59781, in Zabbix agent from Zabbix LLC. Versions before 6.0.48, 7.0.29 and 7.4.13 are listed. The advisory says improper installation permissions may let an unauthorized DLL load and code run with administrator privileges. It advises updating to the latest version.
Signal Timeline
A quick visual path for analysts before reading the full brief.
- 1
JVN#42011956 first published.
Executive Summary: JVN#42011956 reports a DLL loading vulnerability, CVE-2026-59781, in Zabbix agent from Zabbix LLC. Versions before 6.0.48, 7.0.29 and 7.4.13 are listed. The advisory says improper installation permissions may let an unauthorized DLL load and code run with administrator privileges. It advises updating to the latest version.
Why It Matters
JVN#42011956 describes a DLL loading vulnerability in Zabbix agent, a product provided by Zabbix LLC. The advisory states that the agent may load an unauthorized DLL because of improper file access permission settings at installation time, classified as CWE-276. The tracked identifier is CVE-2026-59781.
The affected versions listed are Zabbix agent versions earlier than 6.0.48, earlier than 7.0.29, and earlier than 7.4.13. The listing is organized by release branch, so teams should compare each installed agent against the fixed version for its own branch rather than assuming a single cutoff.
Technical Signal
On scoring, the advisory gives two values for CVE-2026-59781. The CVSS v4.0 base score is 5.4, with a vector of local attack, low attack complexity, attack requirements present, low privileges required and passive user interaction. The CVSS v3.0 base score is 6.7, with a vector of local attack, high attack complexity, low privileges required and user interaction required. The extracted text does not attach severity words to these scores, so this brief does not add any.
The stated impact is that arbitrary code may be executed with administrator privileges. The word "may" matters. The advisory describes a possibility that follows from loading an unauthorized DLL, not a confirmed exploitation event. Nothing in the source says the flaw is being exploited, and it does not describe any victims or attack campaigns.
Operational Impact
The vendor's release note, quoted in the advisory, gives a more specific mechanism. It says improper validation of custom installation directories on Windows could allow installation into locations with unsafe permissions, which increases the risk of DLL sideloading. This points to a deployment-time condition and not a generic remote flaw. The CVSS vectors in the advisory show local attack vectors. The advisory does not say which deployments use custom installation directories, so readers should not assume how many are affected.
The remediation is to update to the latest version based on information from the developer. The advisory links to the Zabbix LLC release notes. Operations and monitoring teams that own Zabbix agents should inventory installed agent versions, identify which hosts fall into the three affected branches, and plan updates according to the vendor's fixed releases.
What To Watch
Because the vendor note refers to custom installation directories on Windows, a reasonable monitoring implication is to review how agents were installed, including any non-default paths, and who can write to those locations. This is general reader guidance and not a claim made by the advisory. Teams can also ask whether their deployment tooling or installation scripts set custom directories.
On provenance, the advisory says the vulnerability was reported to IPA by a reporter from GMO Cybersecurity by Ierae, Inc. under the information security early warning partnership. JPCERT/CC coordinated with the developer. The advisory was first published on 2026-08-28 and last updated on 2026-11-09, when the affected systems and vendor information sections were updated. It is also tracked as JVNDB-2026-000124 in JVN iPedia.
The source does not say what privileges an attacker needs beyond the low privileges shown in the vectors, and it gives no exploit details, proof of concept or evidence of in-the-wild use. It also does not name sectors or countries affected. Readers should treat this as a patch-management item for Zabbix agent deployments, keep the vendor release notes as the authority on fixed builds, and watch for further updates to the JVN entry.
Event Type: security
Importance: medium
Affected Companies
- Zabbix LLC
- JPCERT/CC
- IPA
- GMO Cybersecurity by Ierae, Inc.
Affected Sectors
- Software
- IT operations monitoring
- Vulnerability management
Key Numbers
- CVSS v4.0 base score for CVE-2026-59781: 5.4
- CVSS v3.0 base score for CVE-2026-59781: 6.7
- Affected: Zabbix agent versions earlier than (6.0 branch): 6.0.48
- Affected: Zabbix agent versions earlier than (7.0 branch): 7.0.29
- Affected: Zabbix agent versions earlier than (7.4 branch): 7.4.13
Timeline
- JVN#42011956 first published.
Frequently Asked Questions
What is JVN#42011956?
JVN#42011956 is a JVN advisory about a DLL loading vulnerability in Zabbix agent from Zabbix LLC. It is tracked as CVE-2026-59781 and stems from improper file access permission settings at installation time (CWE-276). The advisory says an unauthorized DLL may be loaded.
Which Zabbix agent versions are affected?
The advisory lists Zabbix agent versions earlier than 6.0.48, earlier than 7.0.29, and earlier than 7.4.13. Teams should check each installed agent against the fixed version for its own release branch.
What is the stated impact of CVE-2026-59781?
The advisory says arbitrary code may be executed with administrator privileges. It phrases this as a possibility. It does not report active exploitation or confirmed incidents, so readers should not read it as evidence of attacks.
How should affected teams respond?
The advisory tells readers to update to the latest version using information from the developer. It links to the Zabbix LLC release notes, which describe improper validation of custom installation directories on Windows that could increase DLL sideloading risk.