Zabbix 6.0 (LTS)
Zabbix 6.0 (LTS)
The Zabbix 6.0 (LTS) reaches end of service life on Feb 28, 2027. Third-party support keeps it managed past that date — issue management, vulnerability remediation, and compliance maintenance from 24/7 engineers.
24/7 engineers own your Zabbix 6.0 (LTS) incidents end to end.
Mitigation and patch-around guidance when the vendor no longer ships fixes.
Controls evidence and documentation that keep auditors satisfied.
Specifications
- product
- zabbix
- release
- 6.0
- product Label
- Zabbix
- release Label
- 6.0 (LTS)
- codename
- lts
- true
- latest Version
- 6.0.48
- release Date
- 2022-02-08
- maintained
- true
- source Url
- https://endoflife.date/zabbix
Lifecycle Dates
- End of Service Life
- Feb 28, 2027
- Last OEM Support
- Feb 28, 2025
OEM vs. 3rd Party Support
See how third-party support compares to the vendor contract for Zabbix 6.0 (LTS) — monitoring, break/fix, vulnerability work, operations and compliance, before and after EOSL.
| Feature | OEM Support | 3rd Party Support |
|---|---|---|
| Post-EOSL Support | ||
| Break/Fix Support | Until EOSL | |
| 24/7 Monitoring | ||
| Vulnerability Scanning & Remediation | ||
| Managed Operations | ||
| Procedure & Configuration Review | ||
| Compliance & Audit Documentation | Limited | |
| Discounted Migration to Other Platforms |
Why Choose 3rd Party Support for Zabbix 6.0 (LTS)?
Vulnerability Remediation
Scanning, mitigation and patch-around guidance for Zabbix 6.0 (LTS) when the vendor no longer ships fixes.
Compliance Maintenance
Procedure review, controls evidence and the documentation auditors ask for — maintained continuously, not scrambled at audit time.
24/7 Expert Support
Engineers who know this release monitor, manage and fix issues around the clock — break/fix to managed operations.
Zabbix 6.0 (LTS) Support: Frequently Asked Questions
Is the Zabbix 6.0 (LTS) still supported?
Yes, but Zabbix support for the Zabbix 6.0 (LTS) ends on Feb 28, 2027. You can upgrade on the vendor's schedule, or move to third-party support and keep the release you're on — issues managed, vulnerabilities remediated, compliance maintained.
When is the Zabbix 6.0 (LTS) end of service life (EOSL) date?
Zabbix lists the end of service life for the Zabbix 6.0 (LTS) as Feb 28, 2027.
Can I keep using the Zabbix 6.0 (LTS) after its EOSL date?
Yes. EOSL means Zabbix stops issuing patches and support — the software itself keeps running. Third-party support covers it from there: issue management, security vulnerability remediation, and the compliance documentation auditors ask for, for as long as you choose to run it.
How much does third-party support for the Zabbix 6.0 (LTS) cost?
Typically 40-70% below the OEM maintenance renewal price. Exact pricing depends on quantity, service level and location — request a quote and we respond within 24 hours.
Known Vulnerabilities Affecting Zabbix 6.0 (LTS)
40 published CVEs affect the Zabbix 6.0 (LTS), including 14 rated critical or high severity. Our 24/7 engineers help you assess exposure, prioritize fixes and apply available patches.
| CVE | Severity | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2024-42327 | CRITICAL | 9.9 | Nov 27, 2024 | A non-admin user account on the Zabbix frontend with the default User role, or with any other role that gives API access can exploit this vulnerability. An SQLi exists in the CUser class in the addRelatedObjects function, this function is being called from the CUser.get function which is available for every user who has API access. |
| CVE-2023-32722 | CRITICAL | 9.6 | Oct 12, 2023 | The zabbix/src/libs/zbxjson module is vulnerable to a buffer overflow when parsing JSON files via zbx_json_open. |
| CVE-2024-42330 | CRITICAL | 9.1 | Nov 27, 2024 | The HttpRequest object allows to get the HTTP headers from the server's response after sending the request. The problem is that the returned strings are created directly from the data returned by the server and are not correctly encoded for JavaScript. This allows to create internal strings that can be used to access hidden properties of objects. |
| CVE-2024-36461 | CRITICAL | 9.1 | Aug 12, 2024 | Within Zabbix, users have the ability to directly modify memory pointers in the JavaScript engine. |
| CVE-2024-22120 | CRITICAL | 9.1 | May 17, 2024 | Zabbix server can perform command execution for configured scripts. After command is executed, audit entry is added to "Audit Log". Due to "clientip" field is not sanitized, it is possible to injection SQL into "clientip" and exploit time based blind SQL injection. |
| CVE-2023-32724 | CRITICAL | 9.1 | Oct 12, 2023 | Memory pointer is in a property of the Ducktape object. This leads to multiple vulnerabilities related to direct memory access and manipulation. |
| CVE-2022-23131 | CRITICAL | 9.1 | Jan 13, 2022 | In the case of instances where the SAML SSO authentication is enabled (non-default), session data can be modified by a malicious actor, because a user login stored in the session was not verified. Malicious unauthenticated actor may exploit this issue to escalate privileges and gain admin access to Zabbix Frontend. To perform the attack, SAML authentication is required to be enabled and the actor has to know the username of Zabbix user (or use the guest account, which is disabled by default). |
| CVE-2024-36466 | HIGH | 8.8 | Nov 28, 2024 | A bug in the code allows an attacker to sign a forged zbx_session cookie, which then allows them to sign in with admin permissions. |
| CVE-2023-29450 | HIGH | 8.5 | Jul 13, 2023 | JavaScript pre-processing can be used by the attacker to gain access to the file system (read-only access on behalf of user "zabbix") on the Zabbix Server or Zabbix Proxy, potentially leading to unauthorized access to sensitive data. |
| CVE-2024-36460 | HIGH | 8.1 | Aug 12, 2024 | The front-end audit log allows viewing of unprotected plaintext passwords, where the passwords are displayed in plain text. |
| CVE-2023-32721 | HIGH | 7.6 | Oct 12, 2023 | A stored XSS has been found in the Zabbix web application in the Maps element if a URL field is set with spaces before URL. |
| CVE-2025-27240 | HIGH | 7.5 | Sep 12, 2025 | A Zabbix adminitrator can inject arbitrary SQL during the autoremoval of hosts by inserting malicious SQL in the 'Visible name' field. |
| CVE-2024-45699 | HIGH | 7.5 | Apr 2, 2025 | The endpoint /zabbix.php?action=export.valuemaps suffers from a Cross-Site Scripting vulnerability via the backurl parameter. This is caused by the reflection of user-supplied data without appropriate HTML escaping or output encoding. As a result, a JavaScript payload may be injected into the above endpoint causing it to be executed within the context of the victim's browser. |
| CVE-2024-36467 | HIGH | 7.5 | Nov 27, 2024 | An authenticated user with API access (e.g.: user with default User role), more specifically a user with access to the user.update API endpoint is enough to be able to add themselves to any group (e.g.: Zabbix Administrators), except to groups that are disabled or having restricted GUI access. |
| CVE-2024-36463 | MEDIUM | 6.5 | Nov 26, 2024 | The implementation of atob in "Zabbix JS" allows to create a string with arbitrary content and use it to access internal properties of objects. |
| CVE-2022-43516 | MEDIUM | 6.5 | Dec 5, 2022 | A Firewall Rule which allows all incoming TCP connections to all programs from any source and to all ports is created in Windows Firewall after Zabbix agent installation (MSI) |
| CVE-2022-23133 | MEDIUM | 6.3 | Jan 13, 2022 | An authenticated user can create a hosts group from the configuration with XSS payload, which will be available for other users. When XSS is stored by an authenticated malicious actor and other users try to search for groups during new host creation, the XSS payload will fire and the actor can steal session cookies and perform session hijacking to impersonate users or take over their accounts. |
| CVE-2024-22121 | MEDIUM | 6.1 | Aug 12, 2024 | A non-admin user can change or remove important features within the Zabbix Agent application, thus impacting the integrity and availability of the application. |
| CVE-2024-45700 | MEDIUM | 6.0 | Apr 2, 2025 | Zabbix server is vulnerable to a DoS vulnerability due to uncontrolled resource exhaustion. An attacker can send specially crafted requests to the server, which will cause the server to allocate an excessive amount of memory and perform CPU-intensive decompression operations, ultimately leading to a service crash. |
| CVE-2023-29458 | MEDIUM | 5.9 | Jul 13, 2023 | Duktape is an 3rd-party embeddable JavaScript engine, with a focus on portability and compact footprint. When adding too many values in valstack JavaScript will crash. This issue occurs due to bug in Duktape 2.6 which is an 3rd-party solution that we use. |
Showing the 20 most severe of 40 known CVEs.
Get Third Party Support