Zabbix third-party support
Zabbix 7.4
Zabbix 7.4
Third-party support for the Zabbix 7.4: 24/7 engineers manage issues, remediate vulnerabilities, and help you maintain compliance — independent of the vendor contract.
EOSL Date: May 31, 2027
Issue Management
24/7 engineers own your Zabbix 7.4 incidents end to end.
Vulnerability Remediation
Mitigation and patch-around guidance when the vendor no longer ships fixes.
Compliance Maintenance
Controls evidence and documentation that keep auditors satisfied.
Specifications
- product
- zabbix
- release
- 7.4
- product Label
- Zabbix
- release Label
- 7.4
- codename
- lts
- latest Version
- 7.4.16
- release Date
- 2025-06-30
- maintained
- true
- source Url
- https://endoflife.date/zabbix
Lifecycle Dates
- End of Service Life
- May 31, 2027
- Last OEM Support
- Nov 12, 2026
OEM vs. 3rd Party Support
See how third-party support compares to the vendor contract for Zabbix 7.4 — monitoring, break/fix, vulnerability work, operations and compliance, before and after EOSL.
| Feature | OEM Support | 3rd Party Support |
|---|---|---|
| Post-EOSL Support | ||
| Break/Fix Support | Until EOSL | |
| 24/7 Monitoring | ||
| Vulnerability Scanning & Remediation | ||
| Managed Operations | ||
| Procedure & Configuration Review | ||
| Compliance & Audit Documentation | Limited | |
| Discounted Migration to Other Platforms |
Why Choose 3rd Party Support for Zabbix 7.4?
Vulnerability Remediation
Scanning, mitigation and patch-around guidance for Zabbix 7.4 when the vendor no longer ships fixes.
Compliance Maintenance
Procedure review, controls evidence and the documentation auditors ask for — maintained continuously, not scrambled at audit time.
24/7 Expert Support
Engineers who know this release monitor, manage and fix issues around the clock — break/fix to managed operations.
Zabbix 7.4 Support: Frequently Asked Questions
Is the Zabbix 7.4 still supported?
Yes. The Zabbix 7.4 is currently supported by Zabbix, and third-party support is available as an alternative — issue management, vulnerability remediation, and compliance help independent of the vendor contract.
When is the Zabbix 7.4 end of service life (EOSL) date?
Zabbix lists the end of service life for the Zabbix 7.4 as May 31, 2027.
Can I keep using the Zabbix 7.4 after its EOSL date?
Yes. EOSL means Zabbix stops issuing patches and support — the software itself keeps running. Third-party support covers it from there: issue management, security vulnerability remediation, and the compliance documentation auditors ask for, for as long as you choose to run it.
How much does third-party support for the Zabbix 7.4 cost?
Typically 40-70% below the OEM maintenance renewal price. Exact pricing depends on quantity, service level and location. You get an indicative price within 24 hours and a firm quote within 48.
Known Vulnerabilities Affecting Zabbix 7.4
23 published CVEs affect the Zabbix 7.4, including 7 rated critical or high severity. Our 24/7 engineers help you assess exposure, prioritize fixes and apply available patches.
| CVE | Severity | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-23921 | HIGH | 8.7 | Mar 24, 2026 | A low privilege Zabbix user with API access can exploit a blind SQL injection vulnerability in include/classes/api/CApiService.php to execute arbitrary SQL selects via the sortfield parameter. Although query results are not returned directly, an attacker can exfiltrate arbitrary database data through time-based techniques, potentially leading to session identifier disclosure and administrator account compromise. |
| CVE-2026-23929 | HIGH | 8.5 | Aug 18, 2026 | Prototype pollution vulnerability in searchParamsToObject() is leading to a persistent XSS in Maps. URL parameter processing was not filtering dangerous properties like __proto__, combined with jQuery's unsafe element creation that traversed the prototype chain. |
| CVE-2026-23933 | HIGH | 7.7 | Aug 18, 2026 | In Zabbix 7.4 the cryptographic key used for signing Frontend sessions has been erroneously written to the database seed. Currently the only known exploitation scenario is for deployments that utilize both - SAML authentication and guest users. In such cases the key can be used to forge valid session cookies, potentially leading to unauthorized access. For other Zabbix deployments this does not have a known impact. |
| CVE-2026-23920 | HIGH | 7.7 | Mar 24, 2026 | Host and event action script input is validated with a regex (set by the administrator), but the validation runs in multiline mode. If ^ and $ anchors are used in user input validation, an injected newline lets authenticated users bypass the check and inject shell commands. |
| CVE-2026-23928 | HIGH | 7.3 | May 6, 2026 | The Item history widget (in Zabbix 7.0+) or the Plain text widget (in Zabbix 6.0) can execute injected JavaScript when HTML display is enabled. This can allow an attacker to perform unauthorized actions depending on which user opens a dashboard containing these widgets. The malicious JavaScript would have to come from a monitored host controlled by the attacker. Note: the Item history widget is a replacement for the Plain text widget since Zabbix 7.0. |
| CVE-2026-23926 | HIGH | 7.3 | May 6, 2026 | An authenticated (non-super) administrator can create a maintenance period with a JavaScript payload that is executed by any user that opens tooltip for that maintenance period in the Host navigator widget. This can allow the attacker to perform unauthorized actions depending on which user opens the tooltip. |
| CVE-2026-23919 | HIGH | 7.1 | Mar 24, 2026 | For performance reasons Zabbix Server/Proxy reuses JavaScript (Duktape) contexts (used in script items, JavaScript reprocessing, Webhooks). This can lead to confidentiality loss where a regular (non-super) Zabbix administrator leaks data for hosts they do not have access to. A fix has been released that makes the built in Zabbix JavaScript objects read-only, but please be advised that usage of global JavaScript variables is not recommended because their content could be leaked. More information |
| CVE-2026-1199 | MEDIUM | 6.9 | Aug 18, 2026 | Zabbix API and Frontend login lockout mechanism has a flaw where several unsuccessful login requests are not properly counted towards the block counter if sent simultaneously, potentially allowing for more password guesses than intended. |
| CVE-2026-23923 | MEDIUM | 6.9 | Mar 24, 2026 | An unauthenticated attacker can exploit the Frontend 'validate' action to blindly instantiate arbitrary PHP classes. The impact depends on environment setup but appears limited at this time. |
| CVE-2026-23935 | MEDIUM | 6.8 | Aug 18, 2026 | A Zabbix administrator is able to read out of bounds memory by utilizing a flaw in script item/preprocessing (JavaScript) HttpRequest logic, leading to potential confidentiality loss. |
| CVE-2026-23924 | MEDIUM | 6.1 | Mar 24, 2026 | Zabbix Agent 2 Docker plugin does not properly sanitize the 'docker.container_info' parameters when forwarding them to the Docker daemon. An attacker capable of invoking Agent 2 can read arbitrary files from running Docker containers by injecting them via the Docker archive API. |
| CVE-2026-23937 | MEDIUM | 6.0 | Aug 18, 2026 | The Zabbix API host.get action can be exploited by authenticated users to extract a host's PSK key leading to potential loss of data integrity. |
| CVE-2026-59781 | MEDIUM | 5.4 | Aug 18, 2026 | When Zabbix Agent was installed on Windows into a custom installation directory, the installer did not verify whether the selected directory had secure access permissions. If the target directory allowed unauthorized users to modify its contents, an attacker could place a malicious DLL that could later be loaded by the application, resulting in DLL sideloading. The installer has been hardened to detect potentially unsafe installation directories and now requires explicit user confirmation before |
| CVE-2026-23931 | MEDIUM | 5.3 | Aug 18, 2026 | The frontend validatate.api.exists action can be exploited by authenticated users to extract plaintext user macro values leading to potential loss of confidentiality. |
| CVE-2026-23930 | MEDIUM | 5.3 | Aug 18, 2026 | An unauthenticated user is able to cause disproportionate CPU load on the Frontend webserver by sending specifically crafted requests to the Frontend popup.testtriggerexpr action, leading to potential denial of service. |
| CVE-2026-23934 | MEDIUM | 5.1 | Aug 18, 2026 | An authenticated user is able to cause disproportionate CPU load on the Frontend webserver by sending specifically crafted requests to the Frontend validate.api.exists action, leading to potential denial of service. |
| CVE-2026-23927 | MEDIUM | 5.1 | May 6, 2026 | A user able to connect to Agent 2 can inject an Oracle TNS connection string via the 'service' parameter. This can lead to Agent 2 connecting to an attacker-controlled server and leaking Oracle database credentials if they are saved in a named session. |
| CVE-2026-23925 | MEDIUM | 5.1 | Mar 6, 2026 | An authenticated Zabbix user (User role) with template/host write permissions is able to create objects via the configuration.import API. This can lead to confidentiality loss by creating unauthorized hosts. Note that the User role is normally not sufficient to create and edit templates/hosts even with write permissions. |
| CVE-2025-49641 | MEDIUM | 5.1 | Oct 3, 2025 | A regular Zabbix user with no permission to the Monitoring -> Problems view is still able to call the problem.view.refresh action and therefore still retrieve a list of active problems. |
| CVE-2025-27231 | MEDIUM | 4.3 | Oct 3, 2025 | The LDAP 'Bind password' value cannot be read after saving, but a Super Admin account can leak it by changing LDAP 'Host' to a rogue LDAP server. To mitigate this, the 'Bind password' value is now reset on 'Host' change. |
Showing the 20 most severe of 23 known CVEs.
Get Third Party SupportRelated Zabbix Products
All Zabbix products →Zabbix 7.4
Price in 24 hours · 40-70% below OEM