CVE-2026-59781 is a high severity DLL sideloading risk in the Zabbix Agent Windows installer. A custom install directory with weak permissions lets an attacker plant a DLL the agent later loads. The installer now warns and asks for confirmation. Check where your agents are installed.
What's affected
- Product: Zabbix Agent installed on Windows with a custom installation directory.
- Affected versions: the Zabbix ticket lists none and no fix version, so check the Zabbix release notes for the packages that include the hardened installer.
- Not at risk: installs in the default location, which has secure permissions.
- Fix described: the installer now detects potentially unsafe directories and requires explicit confirmation before installing there.
How to check if you're exposed
List the directories your Windows agents were installed into, and check who can write there. On a Windows host:
icacls "C:\path\to\zabbix"
Look for entries that give write or modify rights to Users, Authenticated Users or Everyone. Any such entry on the agent directory means a local user could place a DLL there. Fleet wide, your configuration management or software inventory usually records install paths, so query those first.
What to do now
- Inventory agent install directories on Windows hosts.
- Remove write access for non-administrators from the agent directories.
- Reinstall or upgrade with a Zabbix installer that includes the check, and install into a protected path.
- Review deployment scripts that pass a custom install directory.
- Watch for unexpected DLL files in the agent directory.
- Run the free in-browser dependency scan on your lockfile or manifest to see every affected package in one pass.
Why it matters
The weakness is CWE-427 (Uncontrolled Search Path Element). If an attacker can write into a directory the application loads libraries from, a malicious DLL placed there runs with the application's privileges. The Zabbix agent often runs as a service with high privileges, which is why this class matters for monitoring software.
The record scores it 7.8 (High) with a local vector. The Zabbix ticket for the issue rates it 5.4 (Medium) under CVSS 4.0, with priority Minor, so the vendor and the record disagree on severity. The record does not mark it as exploited in the wild.
The lesson reaches beyond Zabbix. Any Windows software installed outside Program Files can inherit weak folder permissions from its parent, for example a directory created under the root of a drive. Auditing the permissions of agent and service install paths is a cheap control that covers many products at once.
Quick check
Is a default install affected?
The Zabbix description is about custom installation directories without secure permissions. A default location that ordinary users cannot write to does not have the weakness.
Sources
Last reviewed: 18 October 2026.
