Zabbix 6.4
Zabbix 6.4
The Zabbix 6.4 reached end of service life on Dec 31, 2024 — Zabbix no longer ships security patches or fixes for it. Our third-party support keeps it safe to run: 24/7 engineers manage issues, remediate vulnerabilities, and help you maintain compliance.
24/7 engineers own your Zabbix 6.4 incidents end to end.
Mitigation and patch-around guidance when the vendor no longer ships fixes.
Controls evidence and documentation that keep auditors satisfied.
Specifications
- product
- zabbix
- release
- 6.4
- product Label
- Zabbix
- release Label
- 6.4
- codename
- lts
- latest Version
- 6.4.21
- release Date
- 2023-03-06
- maintained
- source Url
- https://endoflife.date/zabbix
Lifecycle Dates
- End of Service Life
- Dec 31, 2024
- Last OEM Support
- Jun 30, 2024
OEM vs. 3rd Party Support
See how third-party support compares to the vendor contract for Zabbix 6.4 — monitoring, break/fix, vulnerability work, operations and compliance, before and after EOSL.
| Feature | OEM Support | 3rd Party Support |
|---|---|---|
| Post-EOSL Support | ||
| Break/Fix Support | Until EOSL | |
| 24/7 Monitoring | ||
| Vulnerability Scanning & Remediation | ||
| Managed Operations | ||
| Procedure & Configuration Review | ||
| Compliance & Audit Documentation | Limited | |
| Discounted Migration to Other Platforms |
Why Choose 3rd Party Support for Zabbix 6.4?
Vulnerability Remediation
Scanning, mitigation and patch-around guidance for Zabbix 6.4 when the vendor no longer ships fixes.
Compliance Maintenance
Procedure review, controls evidence and the documentation auditors ask for — maintained continuously, not scrambled at audit time.
24/7 Expert Support
Engineers who know this release monitor, manage and fix issues around the clock — break/fix to managed operations.
Zabbix 6.4 Support: Frequently Asked Questions
Is the Zabbix 6.4 still supported?
Zabbix ended support for the Zabbix 6.4 on Dec 31, 2024 — no more patches or fixes from the vendor. Third-party support keeps it covered: our engineers manage issues, remediate vulnerabilities, and help you maintain compliance for as long as you run it.
When is the Zabbix 6.4 end of service life (EOSL) date?
Zabbix lists the end of service life for the Zabbix 6.4 as Dec 31, 2024.
Can I keep using the Zabbix 6.4 after its EOSL date?
Yes. EOSL means Zabbix stops issuing patches and support — the software itself keeps running. Third-party support covers it from there: issue management, security vulnerability remediation, and the compliance documentation auditors ask for, for as long as you choose to run it.
How much does third-party support for the Zabbix 6.4 cost?
Typically 40-70% below the OEM maintenance renewal price. Exact pricing depends on quantity, service level and location — request a quote and we respond within 24 hours.
Known Vulnerabilities Affecting Zabbix 6.4
27 published CVEs affect the Zabbix 6.4, including 13 rated critical or high severity. Zabbix no longer ships security patches for this release — our engineers provide mitigation guidance, workarounds and hardening support.
| CVE | Severity | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2024-42327 | CRITICAL | 9.9 | Nov 27, 2024 | A non-admin user account on the Zabbix frontend with the default User role, or with any other role that gives API access can exploit this vulnerability. An SQLi exists in the CUser class in the addRelatedObjects function, this function is being called from the CUser.get function which is available for every user who has API access. |
| CVE-2023-32722 | CRITICAL | 9.6 | Oct 12, 2023 | The zabbix/src/libs/zbxjson module is vulnerable to a buffer overflow when parsing JSON files via zbx_json_open. |
| CVE-2024-42330 | CRITICAL | 9.1 | Nov 27, 2024 | The HttpRequest object allows to get the HTTP headers from the server's response after sending the request. The problem is that the returned strings are created directly from the data returned by the server and are not correctly encoded for JavaScript. This allows to create internal strings that can be used to access hidden properties of objects. |
| CVE-2024-36461 | CRITICAL | 9.1 | Aug 12, 2024 | Within Zabbix, users have the ability to directly modify memory pointers in the JavaScript engine. |
| CVE-2024-22120 | CRITICAL | 9.1 | May 17, 2024 | Zabbix server can perform command execution for configured scripts. After command is executed, audit entry is added to "Audit Log". Due to "clientip" field is not sanitized, it is possible to injection SQL into "clientip" and exploit time based blind SQL injection. |
| CVE-2023-32724 | CRITICAL | 9.1 | Oct 12, 2023 | Memory pointer is in a property of the Ducktape object. This leads to multiple vulnerabilities related to direct memory access and manipulation. |
| CVE-2024-36466 | HIGH | 8.8 | Nov 28, 2024 | A bug in the code allows an attacker to sign a forged zbx_session cookie, which then allows them to sign in with admin permissions. |
| CVE-2023-29450 | HIGH | 8.5 | Jul 13, 2023 | JavaScript pre-processing can be used by the attacker to gain access to the file system (read-only access on behalf of user "zabbix") on the Zabbix Server or Zabbix Proxy, potentially leading to unauthorized access to sensitive data. |
| CVE-2024-36460 | HIGH | 8.1 | Aug 12, 2024 | The front-end audit log allows viewing of unprotected plaintext passwords, where the passwords are displayed in plain text. |
| CVE-2023-32721 | HIGH | 7.6 | Oct 12, 2023 | A stored XSS has been found in the Zabbix web application in the Maps element if a URL field is set with spaces before URL. |
| CVE-2025-27240 | HIGH | 7.5 | Sep 12, 2025 | A Zabbix adminitrator can inject arbitrary SQL during the autoremoval of hosts by inserting malicious SQL in the 'Visible name' field. |
| CVE-2024-45699 | HIGH | 7.5 | Apr 2, 2025 | The endpoint /zabbix.php?action=export.valuemaps suffers from a Cross-Site Scripting vulnerability via the backurl parameter. This is caused by the reflection of user-supplied data without appropriate HTML escaping or output encoding. As a result, a JavaScript payload may be injected into the above endpoint causing it to be executed within the context of the victim's browser. |
| CVE-2024-36467 | HIGH | 7.5 | Nov 27, 2024 | An authenticated user with API access (e.g.: user with default User role), more specifically a user with access to the user.update API endpoint is enough to be able to add themselves to any group (e.g.: Zabbix Administrators), except to groups that are disabled or having restricted GUI access. |
| CVE-2024-36463 | MEDIUM | 6.5 | Nov 26, 2024 | The implementation of atob in "Zabbix JS" allows to create a string with arbitrary content and use it to access internal properties of objects. |
| CVE-2024-22121 | MEDIUM | 6.1 | Aug 12, 2024 | A non-admin user can change or remove important features within the Zabbix Agent application, thus impacting the integrity and availability of the application. |
| CVE-2023-29458 | MEDIUM | 5.9 | Jul 13, 2023 | Duktape is an 3rd-party embeddable JavaScript engine, with a focus on portability and compact footprint. When adding too many values in valstack JavaScript will crash. This issue occurs due to bug in Duktape 2.6 which is an 3rd-party solution that we use. |
| CVE-2023-29449 | MEDIUM | 5.9 | Jul 13, 2023 | JavaScript preprocessing, webhooks and global scripts can cause uncontrolled CPU, memory, and disk I/O utilization. Preprocessing/webhook/global script configuration and testing are only available to Administrative roles (Admin and Superadmin). Administrative privileges should be typically granted to users who need to perform tasks that require more control over the system. The security risk is limited because not all users have this level of access. |
| CVE-2024-22119 | MEDIUM | 5.5 | Feb 9, 2024 | The cause of vulnerability is improper validation of form input field “Name” on Graph page in Items section. |
| CVE-2023-29452 | MEDIUM | 5.5 | Jul 13, 2023 | Currently, geomap configuration (Administration -> General -> Geographical maps) allows using HTML in the field “Attribution text” when selected “Other” Tile provider. |
| CVE-2023-29451 | MEDIUM | 4.7 | Jul 13, 2023 | Specially crafted string can cause a buffer overrun in the JSON parser library leading to a crash of the Zabbix Server or a Zabbix Proxy. |
Showing the 20 most severe of 27 known CVEs.
Get Third Party Support