Zabbix Agent/Agent2 for Windows Vulnerability Could Allow Privilege Escalation
A security vulnerability has been identified in Zabbix Agent and Agent2 for Windows, which can potentially allow local attackers to gain elevated system privileges.
A security vulnerability has been identified in Zabbix Agent and Agent2 for Windows, which can potentially allow local attackers to gain elevated system privileges.
The vulnerability, designated as CVE-2025-27237 , is associated with the handling of the OpenSSL configuration file by the agent.
An attacker with restricted access on a Windows system could exploit this flaw to escalate privileges to the SYSTEM level.
Zabbix is an open-source monitoring tool used for observing network devices, servers, and applications. Its Agent and Agent2 components operate with elevated permissions on Windows to gather detailed system metrics.
The secure communication configuration, utilizing OpenSSL , depends on an external file intended to be modifiable only by administrators. However, in the impacted versions, this file is accessed from a directory writable by low-privileged users.
In versions 6.0.0 through 6.0.40, 7.0.0 through 7.0.17, 7.2.0 through 7.2.11, and 7.4.0 through 7.4.1, the path to the OpenSSL configuration file is insecure.
The vulnerability, designated as CVE-2025-27237 , is associated with the handling of the OpenSSL configuration file by the agent.
A local user can alter the file to introduce a malicious DLL. When the Zabbix Agent or Agent2 service restarts, it loads the corrupted configuration and executes the attacker's code with SYSTEM privileges, granting complete control over the host.
CVE ID Affected Versions Impact CVSS 4.0 Score Vector
CVE-2025-27237 6.0.0 – 6.0.40
7.4.0 – 7.4.1 Local privilege escalation 7.3 (High)
The vulnerability was reported by researcher himbeer through the HackerOne bug bounty program and has been classified as a major security defect. Zabbix Support Team has confirmed and addressed the issue in recent patch releases.
Users operating Zabbix Agent or Agent2 on Windows are strongly advised to upgrade to the fixed versions:
Upgrading addresses the insecure configuration path and eliminates the possibility for non-administrative accounts to alter critical files.
Following the update, restart the Zabbix Agent or Agent2 service to implement the patch. No alternative workarounds exist besides applying the update.
Timely installation of the updated versions can prevent attackers from exploiting this vulnerability to gain full control of Windows hosts observed by Zabbix.
Based on reporting by GBHackers.