CVE-2024-42327

The vulnerability in the Zabbix frontend arises from a critical SQL injection flaw within the CUser class, specifically in the addRelatedObjects function. This function is invoked by the CUser.get method, which is accessible to any user with API access, including those with default or non-admin roles. The flaw allows an attacker to manipulate SQL queries by injecting malicious code through crafted API requests. Given the high CVSS score of 9.9, this vulnerability poses a significant risk, as it can lead to unauthorized data access, data manipulation, or even complete system compromise if exploited effectively.

Attack vectors for this vulnerability are particularly concerning due to the accessibility of the affected function. Any user with API access can exploit the SQL injection flaw, making it a prime target for attackers who may not require elevated privileges. An attacker could craft a request that alters the SQL query executed by the addRelatedObjects function, potentially allowing them to extract sensitive information from the database, such as user credentials, configuration settings, or proprietary data. Moreover, the exploitation could be automated, enabling attackers to launch mass attacks against multiple instances of the affected product, increasing the likelihood of successful breaches.

The real-world impact of this vulnerability is profound, especially for organizations relying on Zabbix for monitoring and management of their IT infrastructure. Successful exploitation could result in unauthorized access to critical systems, leading to data breaches, loss of sensitive information, and significant operational disruptions. The business risks associated with such incidents include financial losses, reputational damage, and potential regulatory penalties, particularly if sensitive data is exposed. Organizations may also face increased scrutiny from stakeholders and customers, which can further exacerbate the long-term effects of a successful attack.

To detect and mitigate the risks associated with this vulnerability, organizations should adopt a multi-faceted approach. Regular security audits and code reviews can help identify and remediate SQL injection vulnerabilities before they can be exploited. Implementing web application firewalls (WAFs) can provide an additional layer of defense by filtering out malicious requests that attempt to exploit the flaw. Furthermore, organizations should enforce the principle of least privilege, ensuring that users with API access have only the necessary permissions to perform their roles. This can help limit the potential impact of an attack, as even if a non-admin user account is compromised, the damage may be contained.

In conclusion, the SQL injection vulnerability in the Zabbix frontend represents a critical threat that requires immediate attention from organizations utilizing this monitoring solution. By understanding the technical details, potential attack vectors, and real-world implications, cybersecurity professionals can develop effective strategies for detection and mitigation. Proactive measures, including regular security assessments and stringent access controls, are essential to safeguard against exploitation and protect sensitive data from unauthorized access.

CSURFACE threat intelligence has detected a marked escalation in exploitation attempts targeting CVE-2024-42327, with a significant increase in observed activity among non-admin users leveraging API access. This surge coincides with the wider availability and refinement of multiple proof-of-concept exploits circulating on public repositories, which have gained traction within attacker communities. The amplification in exploitation attempts underscores the vulnerability’s criticality, as it enables unauthorized SQL injection through commonly accessible API functions, broadening the potential attack surface beyond privileged accounts. While the EPSS score remains high and stable, the intensified exploitation activity signals an elevated operational risk for organizations using Zabbix, particularly those with default or loosely controlled user roles. This evolving threat landscape demands heightened vigilance as adversaries capitalize on accessible attack vectors to achieve remote code execution, increasing the likelihood of impactful breaches.

Update 2 — July 22, 2026

CSURFACE threat intelligence has identified a marked escalation in exploitation attempts targeting CVE-2024-42327, with our telemetry indicating a significant uptick in adversary activity leveraging the vulnerability’s API access vector. This surge coincides with the proliferation of multiple new proof-of-concept exploits on public repositories, which have garnered increased attention within attacker communities, thereby lowering the technical barrier for exploitation. The convergence of heightened detection rates and expanding exploit availability amplifies the operational risk for organizations running Zabbix instances, especially those maintaining default or permissive user roles that grant API access. While the EPSS score remains stable, the qualitative increase in exploitation attempts underscores a shift toward more aggressive and widespread targeting, elevating the threat level from critical to imminently active. Defenders should recognize that this vulnerability is no longer primarily theoretical or limited to niche threat actors but is increasingly weaponized in the wild, signaling an urgent need for enhanced monitoring and response capabilities.

Update 3 — August 14, 2026

CSURFACE threat intelligence has identified a marked escalation in exploitation attempts targeting CVE-2024-42327, accompanied by the emergence of multiple new proof-of-concept exploits gaining traction within attacker communities. Our telemetry indicates that adversaries are increasingly leveraging API access roles with minimal privileges to exploit the SQL injection vulnerability, broadening the attack surface beyond previously observed scenarios. This shift reflects a growing operationalization of the vulnerability, moving it from a high-risk theoretical concern to an actively exploited vector in the wild. The persistence of a high EPSS score combined with intensified detection activity underscores an elevated threat posture. Defenders should interpret this as a clear indication that exploitation efforts are becoming more sophisticated and widespread, increasing the likelihood of successful compromise in environments where default or permissive user roles remain unmitigated. Consequently, the threat level associated with CVE-2024-42327 has escalated from critical to imminently active, demanding heightened vigilance in monitoring API interactions and anomalous user behaviors.