CVE-2025-27237: Zabbix Agent Flaw Allows Local Privilege Escalation via OpenSSL DLL Injection

CVE-2025-27237 is a newly disclosed vulnerability in Zabbix Agent and Agent 2 for Windows that could enable local attackers to gain elevated privileges by exploiting a DLL injection flaw in the OpenSSL configuration handling. According to Zabbix’s advisory, the problem stems from how the OpenSSL configuration file is loaded from a path writable by low-privileged users, creating an opportunity for manipulation.

An attacker with a local Windows account could modify the configuration to inject a malicious DLL, which would be loaded when the agent starts and could lead to privilege escalation or persistence after a restart. The vulnerability carries a CVSS score of 7.3 (High) and has been patched in the latest Zabbix releases; it cannot be exploited remotely.

Fixed versions are available across all supported branches, including 6.0 LTS (6.0.41 for after 6.0.0–6.0.40), 7.0 (7.0.18 for after 7.0.0–7.0.17), 7.2 (7.2.12 for after 7.2.0–7.2.11), and 7.4 (7.4.2 for 7.4.0–7.4.1). Zabbix recommends immediate upgrades and a review of file system permissions for existing agent installations.