---
id: CVE-2026-23934
title: >-
  An authenticated user is able to cause disproportionate CPU load on the
  Frontend webserver by sending specifically crafted requests to the Frontend
  validate.api.exists action, leading to potential denial of service.
summary: >-
  An authenticated user is able to cause disproportionate CPU load on the
  Frontend webserver by sending specifically crafted requests to the Frontend
  validate.api.exists action, leading to potential denial of service.
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-405
vendor: zabbix
product: zabbix
affected:
  - 'zabbix >= 7.4.0, < 7.4.12'
patched:
  - zabbix 7.4.12
published: '2026-08-18'
updated: '2026-09-23'
sourceUpdated: '2026-09-23T14:30:27.420'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-23934'
references:
  - url: 'https://support.zabbix.com/browse/ZBX-28072'
    label: security@zabbix.com
tags:
  - nvd
epss: 0.00555
epssPercentile: 0.46126
ingestedAt: '2026-09-23T15:26:23.403Z'
---

## Overview

An authenticated user is able to cause disproportionate CPU load on the Frontend webserver by sending specifically crafted requests to the Frontend validate.api.exists action, leading to potential denial of service.

## Affected

- `zabbix >= 7.4.0, < 7.4.12`

## Remediation

Upgrade past the affected range:

- `zabbix 7.4.12`