Zabbix 7.0 (LTS)
Zabbix 7.0 (LTS)
Third-party support for the Zabbix 7.0 (LTS): 24/7 engineers manage issues, remediate vulnerabilities, and help you maintain compliance — independent of the vendor contract.
24/7 engineers own your Zabbix 7.0 (LTS) incidents end to end.
Mitigation and patch-around guidance when the vendor no longer ships fixes.
Controls evidence and documentation that keep auditors satisfied.
Specifications
- product
- zabbix
- release
- 7.0
- product Label
- Zabbix
- release Label
- 7.0 (LTS)
- codename
- lts
- true
- latest Version
- 7.0.30
- release Date
- 2024-06-04
- maintained
- true
- source Url
- https://endoflife.date/zabbix
Lifecycle Dates
- End of Service Life
- Jun 30, 2029
- Last OEM Support
- Jun 30, 2027
OEM vs. 3rd Party Support
See how third-party support compares to the vendor contract for Zabbix 7.0 (LTS) — monitoring, break/fix, vulnerability work, operations and compliance, before and after EOSL.
| Feature | OEM Support | 3rd Party Support |
|---|---|---|
| Post-EOSL Support | ||
| Break/Fix Support | Until EOSL | |
| 24/7 Monitoring | ||
| Vulnerability Scanning & Remediation | ||
| Managed Operations | ||
| Procedure & Configuration Review | ||
| Compliance & Audit Documentation | Limited | |
| Discounted Migration to Other Platforms |
Why Choose 3rd Party Support for Zabbix 7.0 (LTS)?
Vulnerability Remediation
Scanning, mitigation and patch-around guidance for Zabbix 7.0 (LTS) when the vendor no longer ships fixes.
Compliance Maintenance
Procedure review, controls evidence and the documentation auditors ask for — maintained continuously, not scrambled at audit time.
24/7 Expert Support
Engineers who know this release monitor, manage and fix issues around the clock — break/fix to managed operations.
Zabbix 7.0 (LTS) Support: Frequently Asked Questions
Is the Zabbix 7.0 (LTS) still supported?
Yes. The Zabbix 7.0 (LTS) is currently supported by Zabbix, and third-party support is available as an alternative — issue management, vulnerability remediation, and compliance help independent of the vendor contract.
When is the Zabbix 7.0 (LTS) end of service life (EOSL) date?
Zabbix lists the end of service life for the Zabbix 7.0 (LTS) as Jun 30, 2029.
Can I keep using the Zabbix 7.0 (LTS) after its EOSL date?
Yes. EOSL means Zabbix stops issuing patches and support — the software itself keeps running. Third-party support covers it from there: issue management, security vulnerability remediation, and the compliance documentation auditors ask for, for as long as you choose to run it.
How much does third-party support for the Zabbix 7.0 (LTS) cost?
Typically 40-70% below the OEM maintenance renewal price. Exact pricing depends on quantity, service level and location — request a quote and we respond within 24 hours.
Known Vulnerabilities Affecting Zabbix 7.0 (LTS)
36 published CVEs affect the Zabbix 7.0 (LTS), including 15 rated critical or high severity. Our 24/7 engineers help you assess exposure, prioritize fixes and apply available patches.
| CVE | Severity | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2024-42327 | CRITICAL | 9.9 | Nov 27, 2024 | A non-admin user account on the Zabbix frontend with the default User role, or with any other role that gives API access can exploit this vulnerability. An SQLi exists in the CUser class in the addRelatedObjects function, this function is being called from the CUser.get function which is available for every user who has API access. |
| CVE-2024-22116 | CRITICAL | 9.9 | Aug 12, 2024 | An administrator with restricted permissions can exploit the script execution functionality within the Monitoring Hosts section. The lack of default escaping for script parameters enabled this user ability to execute arbitrary code via the Ping script, thereby compromising infrastructure. |
| CVE-2023-32722 | CRITICAL | 9.6 | Oct 12, 2023 | The zabbix/src/libs/zbxjson module is vulnerable to a buffer overflow when parsing JSON files via zbx_json_open. |
| CVE-2024-42330 | CRITICAL | 9.1 | Nov 27, 2024 | The HttpRequest object allows to get the HTTP headers from the server's response after sending the request. The problem is that the returned strings are created directly from the data returned by the server and are not correctly encoded for JavaScript. This allows to create internal strings that can be used to access hidden properties of objects. |
| CVE-2024-36461 | CRITICAL | 9.1 | Aug 12, 2024 | Within Zabbix, users have the ability to directly modify memory pointers in the JavaScript engine. |
| CVE-2024-22120 | CRITICAL | 9.1 | May 17, 2024 | Zabbix server can perform command execution for configured scripts. After command is executed, audit entry is added to "Audit Log". Due to "clientip" field is not sanitized, it is possible to injection SQL into "clientip" and exploit time based blind SQL injection. |
| CVE-2023-32724 | CRITICAL | 9.1 | Oct 12, 2023 | Memory pointer is in a property of the Ducktape object. This leads to multiple vulnerabilities related to direct memory access and manipulation. |
| CVE-2024-36466 | HIGH | 8.8 | Nov 28, 2024 | A bug in the code allows an attacker to sign a forged zbx_session cookie, which then allows them to sign in with admin permissions. |
| CVE-2024-36465 | HIGH | 8.6 | Apr 2, 2025 | A low privilege (regular) Zabbix user with API access can use SQL injection vulnerability in include/classes/api/CApiService.php to execute arbitrary SQL commands via the groupBy parameter. |
| CVE-2024-36460 | HIGH | 8.1 | Aug 12, 2024 | The front-end audit log allows viewing of unprotected plaintext passwords, where the passwords are displayed in plain text. |
| CVE-2023-32721 | HIGH | 7.6 | Oct 12, 2023 | A stored XSS has been found in the Zabbix web application in the Maps element if a URL field is set with spaces before URL. |
| CVE-2025-27240 | HIGH | 7.5 | Sep 12, 2025 | A Zabbix adminitrator can inject arbitrary SQL during the autoremoval of hosts by inserting malicious SQL in the 'Visible name' field. |
| CVE-2024-45699 | HIGH | 7.5 | Apr 2, 2025 | The endpoint /zabbix.php?action=export.valuemaps suffers from a Cross-Site Scripting vulnerability via the backurl parameter. This is caused by the reflection of user-supplied data without appropriate HTML escaping or output encoding. As a result, a JavaScript payload may be injected into the above endpoint causing it to be executed within the context of the victim's browser. |
| CVE-2024-36467 | HIGH | 7.5 | Nov 27, 2024 | An authenticated user with API access (e.g.: user with default User role), more specifically a user with access to the user.update API endpoint is enough to be able to add themselves to any group (e.g.: Zabbix Administrators), except to groups that are disabled or having restricted GUI access. |
| CVE-2024-36462 | HIGH | 7.5 | Aug 12, 2024 | Uncontrolled resource consumption refers to a software vulnerability where a attacker or system uses excessive resources, such as CPU, memory, or network bandwidth, without proper limitations or controls. This can cause a denial-of-service (DoS) attack or degrade the performance of the affected system. |
| CVE-2024-36463 | MEDIUM | 6.5 | Nov 26, 2024 | The implementation of atob in "Zabbix JS" allows to create a string with arbitrary content and use it to access internal properties of objects. |
| CVE-2024-22121 | MEDIUM | 6.1 | Aug 12, 2024 | A non-admin user can change or remove important features within the Zabbix Agent application, thus impacting the integrity and availability of the application. |
| CVE-2024-45700 | MEDIUM | 6.0 | Apr 2, 2025 | Zabbix server is vulnerable to a DoS vulnerability due to uncontrolled resource exhaustion. An attacker can send specially crafted requests to the server, which will cause the server to allocate an excessive amount of memory and perform CPU-intensive decompression operations, ultimately leading to a service crash. |
| CVE-2024-22119 | MEDIUM | 5.5 | Feb 9, 2024 | The cause of vulnerability is improper validation of form input field “Name” on Graph page in Items section. |
| CVE-2026-23925 | MEDIUM | 5.1 | Mar 6, 2026 | An authenticated Zabbix user (User role) with template/host write permissions is able to create objects via the configuration.import API. This can lead to confidentiality loss by creating unauthorized hosts. Note that the User role is normally not sufficient to create and edit templates/hosts even with write permissions. |
Showing the 20 most severe of 36 known CVEs.
Get Third Party Support