The vulnerability allows an unauthenticated attacker to cause the Zabbix Frontend process to instantiate arbitrary PHP classes by using the “validate” action. This flaw effectively allows code to be executed with the privileges of the web application. The extent of impact depends on the server configuration, but the ability to load arbitrary classes can lead to remote code execution, privileged escape or data exfiltration in some environments.

All Zabbix installations that expose the frontend validate endpoint before the fix are affected. The specific product and version ranges are not listed in the advisory, so any Zabbix software released prior to the official patch could be vulnerable. Administrators should verify the presence of the validate action and consider disabling it if the software version is unknown.

The CVSS score of 6.9 places the vulnerability in the Medium severity range. EPSS data is not available, and it is not yet listed in the CISA KEV catalog. The flaw can be exploited without authentication by sending a request to the validate action. Because the attack vector is a network-accessible web endpoint, the risk is broad and the exploitation requirement is minimal.