Zabbix Agent/Agent2 for Windows Vulnerability Could Allow Privilege Escalation

A security flaw in Zabbix Agent and Agent2 for Windows could allow a local attacker to gain higher system privileges, with the issue tracked as CVE-2025-27237. The vulnerability stems from the way the OpenSSL configuration file is loaded, and affected versions run from 6.0.0 through 6.0.40, 7.0.0 through 7.0.17, 7.2.0 through 7.2.11, and 7.4.0 through 7.4.1.

A local user can replace or modify the OpenSSL configuration file to inject a malicious DLL, and when the Zabbix Agent or Agent2 service restarts, the malformed configuration is loaded and executed with SYSTEM privileges. The flaw is rated at CVSS 7.3 (High), with a 4.0 vector, and was reported by researcher himbeer via the HackerOne bug bounty programme, later confirmed and fixed in recent patch releases.

To mitigate, users should upgrade to fixed versions 6.0.41, 7.0.18, 7.2.12 or 7.4.2 and restart the service after applying the update, as no known workarounds exist aside from updating.