---
id: CVE-2026-59787
title: >-
  The Perl SNMP trap receiver script shipped with Zabbix does not properly
  neutralize the ZBXTRAP record delimiter in trap content
summary: >-
  The Perl SNMP trap receiver script shipped with Zabbix does not properly
  neutralize the ZBXTRAP record delimiter in trap content. This means someone
  able to send SNMP traps can inject a record targeting another host, resulting
  in a loss …
severity: medium
cvss: 5.3
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N'
cwe:
  - CWE-143
vendor: Zabbix
product: Zabbix
affected:
  - Zabbix >= 6.0.0 <= 6.0.47
  - Zabbix >= 7.0.0 <= 7.0.28
  - Zabbix >= 7.4.0 <= 7.4.12
published: '2026-10-05'
updated: '2026-10-06'
sourceUpdated: '2026-10-06T15:27:05.657'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-59787'
references:
  - url: 'https://support.zabbix.com/browse/ZBX-28197'
    label: security@zabbix.com
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-59787.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-59787'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-59787'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-59787'
tags:
  - nvd
  - cve.org
  - csaf
  - vex
  - red-hat
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-05T11:23:21.868482Z'
cvssSource: cna
scores:
  cna: 5.3
  vendor: 4.3
ingestedAt: '2026-10-05T11:18:17.203Z'
epss: 0.00226
epssPercentile: 0.13224
---

## Overview

The Perl SNMP trap receiver script shipped with Zabbix does not properly neutralize the ZBXTRAP record delimiter in trap content. This means someone able to send SNMP traps can inject a record targeting another host, resulting in a loss of integrity.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · updated 2026-10-05 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-59787.json)