Zabbix 7.0 (LTS)
Zabbix 7.0 (LTS)
Third-party support for the Zabbix 7.0 (LTS): 24/7 engineers manage issues, remediate vulnerabilities, and help you maintain compliance — independent of the vendor contract.
24/7 engineers own your Zabbix 7.0 (LTS) incidents end to end.
Mitigation and patch-around guidance when the vendor no longer ships fixes.
Controls evidence and documentation that keep auditors satisfied.
Specifications
- product
- zabbix
- release
- 7.0
- product Label
- Zabbix
- release Label
- 7.0 (LTS)
- codename
- lts
- true
- latest Version
- 7.0.32
- release Date
- 2024-06-04
- maintained
- true
- source Url
- https://endoflife.date/zabbix
Lifecycle Dates
- End of Service Life
- Jun 30, 2029
- Last OEM Support
- Jun 30, 2027
OEM vs. 3rd Party Support
See how third-party support compares to the vendor contract for Zabbix 7.0 (LTS) — monitoring, break/fix, vulnerability work, operations and compliance, before and after EOSL.
| Feature | OEM Support | 3rd Party Support |
|---|---|---|
| Post-EOSL Support | ||
| Break/Fix Support | Until EOSL | |
| 24/7 Monitoring | ||
| Vulnerability Scanning & Remediation | ||
| Managed Operations | ||
| Procedure & Configuration Review | ||
| Compliance & Audit Documentation | Limited | |
| Discounted Migration to Other Platforms |
Why Choose 3rd Party Support for Zabbix 7.0 (LTS)?
Vulnerability Remediation
Scanning, mitigation and patch-around guidance for Zabbix 7.0 (LTS) when the vendor no longer ships fixes.
Compliance Maintenance
Procedure review, controls evidence and the documentation auditors ask for — maintained continuously, not scrambled at audit time.
24/7 Expert Support
Engineers who know this release monitor, manage and fix issues around the clock — break/fix to managed operations.
Zabbix 7.0 (LTS) Support: Frequently Asked Questions
Is the Zabbix 7.0 (LTS) still supported?
Yes. The Zabbix 7.0 (LTS) is currently supported by Zabbix, and third-party support is available as an alternative — issue management, vulnerability remediation, and compliance help independent of the vendor contract.
When is the Zabbix 7.0 (LTS) end of service life (EOSL) date?
Zabbix lists the end of service life for the Zabbix 7.0 (LTS) as Jun 30, 2029.
Can I keep using the Zabbix 7.0 (LTS) after its EOSL date?
Yes. EOSL means Zabbix stops issuing patches and support — the software itself keeps running. Third-party support covers it from there: issue management, security vulnerability remediation, and the compliance documentation auditors ask for, for as long as you choose to run it.
How much does third-party support for the Zabbix 7.0 (LTS) cost?
Typically 40-70% below the OEM maintenance renewal price. Exact pricing depends on quantity, service level and location. You get an indicative price within 24 hours and a firm quote within 48.
Known Vulnerabilities Affecting Zabbix 7.0 (LTS)
50 published CVEs affect the Zabbix 7.0 (LTS), including 21 rated critical or high severity. Our 24/7 engineers help you assess exposure, prioritize fixes and apply available patches.
| CVE | Severity | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2024-42327 | CRITICAL | 9.9 | Nov 27, 2024 | A non-admin user account on the Zabbix frontend with the default User role, or with any other role that gives API access can exploit this vulnerability. An SQLi exists in the CUser class in the addRelatedObjects function, this function is being called from the CUser.get function which is available for every user who has API access. |
| CVE-2024-22116 | CRITICAL | 9.9 | Aug 12, 2024 | An administrator with restricted permissions can exploit the script execution functionality within the Monitoring Hosts section. The lack of default escaping for script parameters enabled this user ability to execute arbitrary code via the Ping script, thereby compromising infrastructure. |
| CVE-2023-32722 | CRITICAL | 9.6 | Oct 12, 2023 | The zabbix/src/libs/zbxjson module is vulnerable to a buffer overflow when parsing JSON files via zbx_json_open. |
| CVE-2024-42330 | CRITICAL | 9.1 | Nov 27, 2024 | The HttpRequest object allows to get the HTTP headers from the server's response after sending the request. The problem is that the returned strings are created directly from the data returned by the server and are not correctly encoded for JavaScript. This allows to create internal strings that can be used to access hidden properties of objects. |
| CVE-2024-36461 | CRITICAL | 9.1 | Aug 12, 2024 | Within Zabbix, users have the ability to directly modify memory pointers in the JavaScript engine. |
| CVE-2024-22120 | CRITICAL | 9.1 | May 17, 2024 | Zabbix server can perform command execution for configured scripts. After command is executed, audit entry is added to "Audit Log". Due to "clientip" field is not sanitized, it is possible to injection SQL into "clientip" and exploit time based blind SQL injection. |
| CVE-2023-32724 | CRITICAL | 9.1 | Oct 12, 2023 | Memory pointer is in a property of the Ducktape object. This leads to multiple vulnerabilities related to direct memory access and manipulation. |
| CVE-2024-36466 | HIGH | 8.8 | Nov 28, 2024 | A bug in the code allows an attacker to sign a forged zbx_session cookie, which then allows them to sign in with admin permissions. |
| CVE-2026-23921 | HIGH | 8.7 | Mar 24, 2026 | A low privilege Zabbix user with API access can exploit a blind SQL injection vulnerability in include/classes/api/CApiService.php to execute arbitrary SQL selects via the sortfield parameter. Although query results are not returned directly, an attacker can exfiltrate arbitrary database data through time-based techniques, potentially leading to session identifier disclosure and administrator account compromise. |
| CVE-2024-36465 | HIGH | 8.6 | Apr 2, 2025 | A low privilege (regular) Zabbix user with API access can use SQL injection vulnerability in include/classes/api/CApiService.php to execute arbitrary SQL commands via the groupBy parameter. |
| CVE-2026-23929 | HIGH | 8.5 | Aug 18, 2026 | Prototype pollution vulnerability in searchParamsToObject() is leading to a persistent XSS in Maps. URL parameter processing was not filtering dangerous properties like __proto__, combined with jQuery's unsafe element creation that traversed the prototype chain. |
| CVE-2024-36460 | HIGH | 8.1 | Aug 12, 2024 | The front-end audit log allows viewing of unprotected plaintext passwords, where the passwords are displayed in plain text. |
| CVE-2026-23920 | HIGH | 7.7 | Mar 24, 2026 | Host and event action script input is validated with a regex (set by the administrator), but the validation runs in multiline mode. If ^ and $ anchors are used in user input validation, an injected newline lets authenticated users bypass the check and inject shell commands. |
| CVE-2023-32721 | HIGH | 7.6 | Oct 12, 2023 | A stored XSS has been found in the Zabbix web application in the Maps element if a URL field is set with spaces before URL. |
| CVE-2025-27240 | HIGH | 7.5 | Sep 12, 2025 | A Zabbix adminitrator can inject arbitrary SQL during the autoremoval of hosts by inserting malicious SQL in the 'Visible name' field. |
| CVE-2024-45699 | HIGH | 7.5 | Apr 2, 2025 | The endpoint /zabbix.php?action=export.valuemaps suffers from a Cross-Site Scripting vulnerability via the backurl parameter. This is caused by the reflection of user-supplied data without appropriate HTML escaping or output encoding. As a result, a JavaScript payload may be injected into the above endpoint causing it to be executed within the context of the victim's browser. |
| CVE-2024-36467 | HIGH | 7.5 | Nov 27, 2024 | An authenticated user with API access (e.g.: user with default User role), more specifically a user with access to the user.update API endpoint is enough to be able to add themselves to any group (e.g.: Zabbix Administrators), except to groups that are disabled or having restricted GUI access. |
| CVE-2024-36462 | HIGH | 7.5 | Aug 12, 2024 | Uncontrolled resource consumption refers to a software vulnerability where a attacker or system uses excessive resources, such as CPU, memory, or network bandwidth, without proper limitations or controls. This can cause a denial-of-service (DoS) attack or degrade the performance of the affected system. |
| CVE-2026-23928 | HIGH | 7.3 | May 6, 2026 | The Item history widget (in Zabbix 7.0+) or the Plain text widget (in Zabbix 6.0) can execute injected JavaScript when HTML display is enabled. This can allow an attacker to perform unauthorized actions depending on which user opens a dashboard containing these widgets. The malicious JavaScript would have to come from a monitored host controlled by the attacker. Note: the Item history widget is a replacement for the Plain text widget since Zabbix 7.0. |
| CVE-2026-23926 | HIGH | 7.3 | May 6, 2026 | An authenticated (non-super) administrator can create a maintenance period with a JavaScript payload that is executed by any user that opens tooltip for that maintenance period in the Host navigator widget. This can allow the attacker to perform unauthorized actions depending on which user opens the tooltip. |
Showing the 20 most severe of 50 known CVEs.
Get Third Party Support