{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0"}],"component":"zabbix","cve_ids":[],"ecosystem":"Debian","ecosystem_qualifier":"Debian:13","exploited":false,"fixed_versions":[],"id":"tcs_01M5NT5XQKH6KYB15M9WTYS12Q","modified_at":"2026-10-07T09:47:34.833386141Z","published_at":"2026-10-05T11:16:59.807Z","references":["https://osv.dev/vulnerability/DEBIAN-CVE-2026-59786","https://security-tracker.debian.org/tracker/CVE-2026-59786"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"DEBIAN-CVE-2026-59786#Debian:13/zabbix","url":"https://osv.dev/vulnerability/DEBIAN-CVE-2026-59786"}],"summary":"Zabbix Server and Proxy accept the active agent heartbeat message regardless of the configured PSK or certificate authentication. This means someone with access to the Zabbix trapper port can report a"}