CVE WatchOct 6, 2026

CVE-2026-59787

The Perl SNMP trap receiver script shipped with Zabbix does not properly neutralize the ZBXTRAP record delimiter in trap content. This means

CVSS

—

No CVSS

EPSS

0.2%

p13

KEV

—

Exploit Today

0-100

Published: Oct 5, 2026 · Last modified: Oct 6, 2026 · CWE-143

EPSS · 30d

0.2%EPSS · 30 days0.2%

2026-10-062026-10-21

Technical description

The Perl SNMP trap receiver script shipped with Zabbix does not properly neutralize the ZBXTRAP record delimiter in trap content. This means someone able to send SNMP traps can inject a record targeting another host, resulting in a loss of integrity.

Official references

support.zabbix.comhttps://support.zabbix.com/browse/ZBX-28197

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-1071818.1 HIG

26.8%

——8Telegram Desktop before 7.2.9 contains an IPC record-separator injection vulnerability in Core::Sandbox that allows remote attackers to inject OPEN: records via crafted tg:// links containing unescaped semicolons. Attackers can reach the interpret: scheme handler to upload local files, including tdata session keys, to an attacker channel, enabling account takeover.15d