Zabbix 7.0.18 → 8.0.0

32 releases · 0 breaking changes · 36 security fixes · 14 advisories fixed

36security0breaking0deprecated82feature483fix

Is 7.0.18 affected?

Vulnerabilities fixed by this upgrade

7.8 CVE-2026-59781 When Zabbix Agent was installed on Windows into a custom installation directory, the installer did not verify whether the selected directory had secure access permissions. If the target directory a…
4.9 CVE-2026-23938 An authenticated administrator is able to crash Zabbix server or proxy by creating specifically crafted preprocessing/script item JavaScript scripts, leading to potential denial of service.
5.4 CVE-2026-23929 Prototype pollution vulnerability in searchParamsToObject() is leading to a persistent XSS in Maps. URL parameter processing was not filtering dangerous properties like __proto__, combined with jQu…
7.5 CVE-2026-23930 An unauthenticated user is able to cause disproportionate CPU load on the Frontend webserver by sending specifically crafted requests to the Frontend popup.testtriggerexpr action, leading to potent…
4.9 CVE-2026-23935 A Zabbix administrator is able to read out of bounds memory by utilizing a flaw in script item/preprocessing (JavaScript) HttpRequest logic, leading to potential confidentiality loss.
6.5 CVE-2026-23937 The Zabbix API host.get action can be exploited by authenticated users to extract a host's PSK key leading to potential loss of data integrity.
3.7 CVE-2026-1199 Zabbix API and Frontend login lockout mechanism has a flaw where several unsuccessful login requests are not properly counted towards the block counter if sent simultaneously, potentially allowing…
6.8 CVE-2026-23928 The Item history widget (in Zabbix 7.0+) or the Plain text widget (in Zabbix 6.0) can execute injected JavaScript when HTML display is enabled. This can allow an attacker to perform unauthorized ac…
6.5 CVE-2026-23927 A user able to connect to Agent 2 can inject an Oracle TNS connection string via the 'service' parameter. This can lead to Agent 2 connecting to an attacker-controlled server and leaking Oracle dat…
6.8 CVE-2026-23926 An authenticated (non-super) administrator can create a maintenance period with a JavaScript payload that is executed by any user that opens tooltip for that maintenance period in the Host navigato…
8.8 CVE-2026-23921 A low privilege Zabbix user with API access can exploit a blind SQL injection vulnerability in include/classes/api/CApiService.php to execute arbitrary SQL selects via the sortfield parameter. Alth…
4.9 CVE-2026-23924 Zabbix Agent 2 Docker plugin does not properly sanitize the 'docker.container_info' parameters when forwarding them to the Docker daemon. An attacker capable of invoking Agent 2 can read arbitrary…
6.0 CVE-2026-23919 For performance reasons Zabbix Server/Proxy reuses JavaScript (Duktape) contexts (used in script items, JavaScript reprocessing, Webhooks). This can lead to confidentiality loss where a regular (no…
8.8 CVE-2026-23920 Host and event action script input is validated with a regex (set by the administrator), but the validation runs in multiline mode. If ^ and $ anchors are used in user input validation, an injected…

Breaking changes

None in the release notes.

Security changes

security Fixes CVE-2026-59781: When Zabbix Agent was installed on Windows into a custom installation directory, the installer did not verify whether the selected directory had secure access permissions. If the target directory a… in 7.4.13
security Fixes CVE-2026-23934: An authenticated user is able to cause disproportionate CPU load on the Frontend webserver by sending specifically crafted requests to the Frontend validate.api.exists action, leading to potential… in 7.4.12
security Fixes CVE-2026-23937: The Zabbix API host.get action can be exploited by authenticated users to extract a host's PSK key leading to potential loss of data integrity. in 7.4.12
security Fixes CVE-2026-23935: A Zabbix administrator is able to read out of bounds memory by utilizing a flaw in script item/preprocessing (JavaScript) HttpRequest logic, leading to potential confidentiality loss. in 7.4.12
security Fixes CVE-2026-1199: Zabbix API and Frontend login lockout mechanism has a flaw where several unsuccessful login requests are not properly counted towards the block counter if sent simultaneously, potentially allowing… in 7.4.12
security Fixes CVE-2026-23933: In Zabbix 7.4 the cryptographic key used for signing Frontend sessions has been erroneously written to the database seed. Currently the only known exploitation scenario is for deployments that util… in 7.4.11
security Fixes CVE-2026-23930: An unauthenticated user is able to cause disproportionate CPU load on the Frontend webserver by sending specifically crafted requests to the Frontend popup.testtriggerexpr action, leading to potent… in 7.4.11
security Fixes CVE-2026-23938: An authenticated administrator is able to crash Zabbix server or proxy by creating specifically crafted preprocessing/script item JavaScript scripts, leading to potential denial of service. in 7.4.11
security Fixes CVE-2026-23931: The frontend validatate.api.exists action can be exploited by authenticated users to extract plaintext user macro values leading to potential loss of confidentiality. in 7.4.11
security Fixes CVE-2026-23929: Prototype pollution vulnerability in searchParamsToObject() is leading to a persistent XSS in Maps. URL parameter processing was not filtering dangerous properties like __proto__, combined with jQu… in 7.4.9
security Fixes CVE-2026-23922: The email media OAuth field 'Client secret' cannot be read after saving, but a Super Admin can leak it by setting a malicious 'Token endpoint'. Changes were made to reset the client secret upon cha… in 7.4.9
security Fixes CVE-2026-23928: The Item history widget (in Zabbix 7.0+) or the Plain text widget (in Zabbix 6.0) can execute injected JavaScript when HTML display is enabled. This can allow an attacker to perform unauthorized ac… in 7.4.8
security Fixes CVE-2026-23926: An authenticated (non-super) administrator can create a maintenance period with a JavaScript payload that is executed by any user that opens tooltip for that maintenance period in the Host navigato… in 7.4.8
security Fixes CVE-2026-23927: A user able to connect to Agent 2 can inject an Oracle TNS connection string via the 'service' parameter. This can lead to Agent 2 connecting to an attacker-controlled server and leaking Oracle dat… in 7.4.8
security Fixes CVE-2026-23923: An unauthenticated attacker can exploit the Frontend 'validate' action to blindly instantiate arbitrary PHP classes. The impact depends on environment setup but appears limited at this time. in 7.4.7
security Fixes CVE-2026-23924: Zabbix Agent 2 Docker plugin does not properly sanitize the 'docker.container_info' parameters when forwarding them to the Docker daemon. An attacker capable of invoking Agent 2 can read arbitrary… in 7.4.7
security Fixes CVE-2026-23921: A low privilege Zabbix user with API access can exploit a blind SQL injection vulnerability in include/classes/api/CApiService.php to execute arbitrary SQL selects via the sortfield parameter. Alth… in 7.4.6
security Fixes CVE-2026-23920: Host and event action script input is validated with a regex (set by the administrator), but the validation runs in multiline mode. If ^ and $ anchors are used in user input validation, an injected… in 7.4.6
security Fixes CVE-2026-23919: For performance reasons Zabbix Server/Proxy reuses JavaScript (Duktape) contexts (used in script items, JavaScript reprocessing, Webhooks). This can lead to confidentiality loss where a regular (no… in 7.4.3
security Fixes CVE-2026-23925: An authenticated Zabbix user (User role) with template/host write permissions is able to create objects via the configuration.import API. This can lead to confidentiality loss by creating unauthori… in 7.4.2
security Fixes CVE-2025-27231: The LDAP 'Bind password' value cannot be read after saving, but a Super Admin account can leak it by changing LDAP 'Host' to a rogue LDAP server. To mitigate this, the 'Bind password' value is now… in 7.4.2
security Fixes CVE-2025-49641: A regular Zabbix user with no permission to the Monitoring -> Problems view is still able to call the problem.view.refresh action and therefore still retrieve a list of active problems. in 7.4.2
security Fixes CVE-2026-59781: When Zabbix Agent was installed on Windows into a custom installation directory, the installer did not verify whether the selected directory had secure access permissions. If the target directory a… in 7.0.29
security Fixes CVE-2026-23937: The Zabbix API host.get action can be exploited by authenticated users to extract a host's PSK key leading to potential loss of data integrity. in 7.0.28
security Fixes CVE-2026-23935: A Zabbix administrator is able to read out of bounds memory by utilizing a flaw in script item/preprocessing (JavaScript) HttpRequest logic, leading to potential confidentiality loss. in 7.0.28
security Fixes CVE-2026-1199: Zabbix API and Frontend login lockout mechanism has a flaw where several unsuccessful login requests are not properly counted towards the block counter if sent simultaneously, potentially allowing… in 7.0.28
security Fixes CVE-2026-23930: An unauthenticated user is able to cause disproportionate CPU load on the Frontend webserver by sending specifically crafted requests to the Frontend popup.testtriggerexpr action, leading to potent… in 7.0.27
security Fixes CVE-2026-23938: An authenticated administrator is able to crash Zabbix server or proxy by creating specifically crafted preprocessing/script item JavaScript scripts, leading to potential denial of service. in 7.0.27
security Fixes CVE-2026-23929: Prototype pollution vulnerability in searchParamsToObject() is leading to a persistent XSS in Maps. URL parameter processing was not filtering dangerous properties like __proto__, combined with jQu… in 7.0.25
security Fixes CVE-2026-23928: The Item history widget (in Zabbix 7.0+) or the Plain text widget (in Zabbix 6.0) can execute injected JavaScript when HTML display is enabled. This can allow an attacker to perform unauthorized ac… in 7.0.24
security Fixes CVE-2026-23926: An authenticated (non-super) administrator can create a maintenance period with a JavaScript payload that is executed by any user that opens tooltip for that maintenance period in the Host navigato… in 7.0.24
security Fixes CVE-2026-23927: A user able to connect to Agent 2 can inject an Oracle TNS connection string via the 'service' parameter. This can lead to Agent 2 connecting to an attacker-controlled server and leaking Oracle dat… in 7.0.24
security Fixes CVE-2026-23924: Zabbix Agent 2 Docker plugin does not properly sanitize the 'docker.container_info' parameters when forwarding them to the Docker daemon. An attacker capable of invoking Agent 2 can read arbitrary… in 7.0.23
security Fixes CVE-2026-23921: A low privilege Zabbix user with API access can exploit a blind SQL injection vulnerability in include/classes/api/CApiService.php to execute arbitrary SQL selects via the sortfield parameter. Alth… in 7.0.22
security Fixes CVE-2026-23920: Host and event action script input is validated with a regex (set by the administrator), but the validation runs in multiline mode. If ^ and $ anchors are used in user input validation, an injected… in 7.0.22
security Fixes CVE-2026-23919: For performance reasons Zabbix Server/Proxy reuses JavaScript (Duktape) contexts (used in script items, JavaScript reprocessing, Webhooks). This can lead to confidentiality loss where a regular (no… in 7.0.19

Every release in between

8.0.0 Nov 5, 2026 Release notes ↗

7.4.16 Oct 20, 2026 Release notes ↗

feature[ZBXNEXT-10786] updated maximum supported TimescaleDB version to 2.30 (mprihodko)

fix[ZBX-27897] fixed time function triggers not working after disabling and enabling item (wiper)

fix[ZBX-26854] fixed handling of null as previous value in preprocessing during item test (vskalbins)

fix[ZBX-23109] fixed automatic setting of SNMP maximum repetition count and community on SNMP version change for host interface (gberzina)

fix[ZBX-24844] added missing filters in EtherLike-MIB discovery (kflorowski)

fix[ZBX-27673] fixed browser item timeout (sboidenko)

fix[ZBX-27888] resumed VMware data collection after pause of more than 1 hour (MVekslers)

fix[ZBX-28164] fixed naming in README.md for MikroTik family templates (egordymov)

fix[ZBX-27778] fixed keyboard navigation to "Edit filter properties" button (aluchko)

fix[ZBX-27967] fixed remote script execution for hosts monitored by proxy group when EnabledGlobalScripts is disabled (scernisenko)

fix[ZBX-24729] fixed unreadable long unit names in SVG graph widget (aluchko)

fix[ZBX-27803] implemented collecting history.get results by sub-periods when limit parameter is given to avoid full table scans (jfreibergs)

fix[ZBX-27909] fixed text area maximum length in host inventory (uolekss)

fix[ZBX-27943] fixed web.page.* checks failing when server requests TLS renegotiation on Zabbix agent 2 (esneiders)

fix[ZBX-26359] fixed Smart plugin handling of smartctl exit statuses and fixed discovery not returning data if one drive failed (opucka)

fix[ZBX-27957] fixed color selection in Pie chart and SVG graph datasets when aggregation is used (dfofanovs)

fix[ZBX-27779] fixed misplacement of "Update" and "Save" buttons after switching filter tabs in Safari (gklavins)

fix[ZBX-27492] fixed unsupported state change error caused by missing host in geomap widget (gklavins)

fix[ZBX-26836] fixed crashes in alert, connector, IPMI, LLD and report managers during Zabbix server shutdown (ademidovs)

fix[ZBX-28146] fixed naming in Veeam Backup & Replication by HTTP template (egordymov)

7.4.15 Sep 23, 2026 Release notes ↗

feature[ZBXNEXT-10451] added Zabbix agent 2 pprof profiler (opucka)

feature[ZBXNEXT-10778] updated Veeam Backup and Replication & Veeam Backup Enterprise Manager by HTTP templates for version 13.1 (egordymov)

fix[ZBX-27793] fixed incorrect screen reader announcements for modal dialog windows (aluchko)

fix[ZBX-28110] fixed simple trigger hintbox closure in SVG graph (dfofanovs)

fix[ZBX-28099] fixed LLD session discovery in Veeam Backup and Replication by HTTP template (egordymov)

fix[ZBX-27857] fixed SVG graph widget legend min/max values for "all" approximation (kastafjevs)

fix[ZBX-28056] fixed script for endpoints requiring the Backup Administrator role in Veeam Backup and Replication by HTTP template (egordymov)

fix[ZBX-26411] fixed report manager failing to send scheduled reports when media types had been renamed (rtrizna)

fix[ZBX-27631] fixed macro resolution in exported item names and tags (vsmelovs)

fix[ZBX-28002] fixed nodata() trigger from flapping into unknown state when 1) log history with only metadata is received 2) preprocessing discards history 3) only old entries outside nodata() period are received (arimdjonoks)

fix[ZBX-26929] fixed duplicate item names in GCP template (kflorowski)

fix[ZBX-27513] fixed runtime errors on PHP 8.5 (Ivo)

fix[ZBX-27956] fixed row-adding event duplication for host/template mass update value mapping tab (scernisenko)

fix[ZBX-28060] implemented inaccessible value mapping label for value mapping in items and item prototypes depending on user permissions (scernisenko)

fix[ZBX-27976] fixed db.odbc.get and db.odbc.discovery database monitor items failing when the first statement in SQL query is not a SELECT (mkorotkov)

fix[ZBX-27437] fixed incorrect housekeeping option validation (ademidovs)

fix[ZBX-27860] fixed agent redirect loop in proxy groups when server goes offline (wiper)

fix[ZBX-26912] fixed redirection of the trigger configuration form on submit (averza)

fix[ZBX-28016] fixed memory leak in item query when expanding user macros (vso)

fix[ZBX-25576] fixed bad URL issue in TOPdesk webhook (kflorowski)

fix[ZBX-23983] fixed typo in the trigger event name for the Generic Java JMX template (smansurovs)

fix[ZBX-28087] fixed README.md files for cloud templates (smansurovs)

fix[ZBX-26475] fixed error handling in configserver items in MongoDB template (kflorowski)

fix[ZBX-27924] fixed trigger recovery expression for Dell PowerEdge by HTTP templates (mruszczyk)

fix[ZBX-28065] fixed missing ellipsis for result field in the item testing form (scernisenko)

fix[ZBX-27204] fixed width of the tree element editing popup in the map navigation tree widget (gklavins)

7.4.14 Aug 25, 2026 Release notes ↗

feature[ZBXNEXT-10720] updated maximum supported TimescaleDB version to 2.29 (mprihodko)

feature[ZBXNEXT-10732] updated help URL from the frontend to documentation (scernisenko)

fix[ZBX-28012] fixed spacing between Host Wizard template tags in the expanded hintbox (scernisenko)

fix[ZBX-27836] fixed PHP runtime errors in user role edit form (Ivo)

fix[ZBX-28045] fixed active checks in case of failed response on Zabbix agent 2 (aetatsu)

fix[ZBX-23057] fixed memory fragmentation trigger and added RSS overhead triggers in Redis by Zabbix agent 2 template (mruszczyk)

fix[ZBX-27746] removed unsupported discovery worker targets and preprocessing worker profiling targets from Zabbix server and proxy help messages and man pages (rtrizna)

fix[ZBX-27791] added multiplier to percent_used metric in Ceph by Zabbix agent 2 template (mruszczyk)

fix[ZBX-27646] removed MS Teams webhook in default data (egordymov)

fix[ZBX-25042] removed discard option for SNMP status items (kflorowski)

fix[ZBX-25663] added node name macro to RabbitMQ node templates (abrosimovs)

fix[ZBX-26229] fixed CPU user and idle time OIDs in Check Point NGFW SNMP template (mruszczyk)

fix[ZBX-25608] fixed missing precision for temperature sensors for Cisco template (kflorowski)

fix[ZBX-22458] fixed cache hit ratio base typo in MSSQL by ODBC template (mruszczyk)

fix[ZBX-25484] fixed incorrect item configuration in default data (egordymov)

fix[ZBX-21236] improved metrics filtering in API response for the Elasticsearch Cluster by HTTP template (smansurovs)

fix[ZBX-24512] fixed memory items in Cisco Nexus 9000 Series by SNMP template (kflorowski)

fix[ZBX-24343] fixed temperature threshold trigger duplication for Cisco IOS by SNMP (kflorowski)

fix[ZBX-27892] fixed dynamic row counter initialization when tags are read-only in host items (uolekss)

fix[ZBX-27893] fixed infinite loop for graphs in hosts monitoring when working time period in GUI is 00:00-24:00 (scernisenko)

fix[ZBX-27646] removed MS Teams webhook based on retired Office 365 Connector (mruszczyk)

fix[ZBX-27908] fixed icon mapping order for individual list item (scernisenko)

fix[ZBX-26465] improved aria-label text for all functional buttons and icons and aria-expanding of side menu elements for Screen Reader users (aluchko)

fix[ZBX-27920] fixed event menu entry parameters being marked as required when they are disabled (scernisenko)

fix[ZBX-25485] fixed language change to work for different environments (gberzina)

fix[ZBX-27921] fixed item and item prototype interval validation for trapper and dependent items (gberzina)

fix[ZBX-27942] fixed time filter error for dashboard in Kiosk mode (scernisenko)

fix[ZBX-25815] removed mention of discovery from SNMP max_repetition help note (vskalbins)

fix[ZBX-27140] fixed overall hintbox positioning (dfofanovs)

7.4.13 Jul 29, 2026 Release notes ↗

securityFixes CVE-2026-59781: When Zabbix Agent was installed on Windows into a custom installation directory, the installer did not verify whether the selected directory had secure access permissions. If the target directory a…

feature[ZBXNEXT-10669] updated maximum supported TimescaleDB version to 2.28 (mprihodko)

feature[ZBXNEXT-10558] updated Veeam Backup and Replication & Veeam Backup Enterprise Manager by HTTP templates (egordymov)

fix[ZBX-28197] improved validation of SNMP trap payload in zabbix_trap_receiver.pl (MVekslers)

fix[ZBX-28196] added heartbeat connection type and frequency validation (sboidenko)

fix[ZBX-28195] implemented validation of parameters for jsrpc.php (Ivo)

fix[ZBX-28194] fixed memory allocation size for binary items on MySQL/MariaDB (sboidenko)

fix[ZBX-28193] fixed JavaScript preprocessing memory initialization (MVekslers)

fix[ZBX-27975] fixed potential VMware collector crash caused by network connectivity issues to vCenter (MVekslers)

fix[ZBX-21745] fixed duplicate discovery key and JavaScript preprocessing in RabbitMQ templates (abrosimovs)

fix[ZBX-26583] fixed incorrectly displayed templates after clearing search field in host wizard (aluchko, gklavins)

fix[ZBX-26953] fixed redirect functionality for discovery rules, discovery prototypes, host prototypes, web scenarios, and maps (msnihach)

fix[ZBX-27665] fixed remote command execution failing for trigger action operations when target host is monitored by proxy group (vsmelovs)

fix[ZBX-27689] fixed permission check for bulk actions in hosts web monitoring list (scernisenko)

fix[ZBX-27922] added retry to persistent buffer writes (esneiders)

fix[ZBX-26916] fixed some websites not having their certificates accessed (dbriedis)

fix[ZBX-27724] fixed build script for Zabbix web service (opucka)

fix[ZBX-18840] fixed misleading comments in Zabbix agent 2 (dbriedis)

fix[ZBX-27024] resolved system.run failing and race conditions (opucka)

fix[ZBX-25578] fixed GCP get db instances script (kflorowski)

fix[ZBX-27139] fixed naming and description of PLE trigger in MSSQL by Zabbix agent 2 template (smansurovs)

fix[ZBX-26704] fixed redundant preprocessing before discarding values (kflorowski)

fix[ZBX-27453] fixed average trend calculation to avoid producing inf values when dealing with DBL_MAX input; updated timeleft() function to return DBL_MAX when threshold cannot be reached and history approaches DBL_MAX (arimdjonoks)

7.4.12 Jul 8, 2026 Release notes ↗

securityFixes CVE-2026-23934: An authenticated user is able to cause disproportionate CPU load on the Frontend webserver by sending specifically crafted requests to the Frontend validate.api.exists action, leading to potential…

securityFixes CVE-2026-23937: The Zabbix API host.get action can be exploited by authenticated users to extract a host's PSK key leading to potential loss of data integrity.

securityFixes CVE-2026-23935: A Zabbix administrator is able to read out of bounds memory by utilizing a flaw in script item/preprocessing (JavaScript) HttpRequest logic, leading to potential confidentiality loss.

securityFixes CVE-2026-1199: Zabbix API and Frontend login lockout mechanism has a flaw where several unsuccessful login requests are not properly counted towards the block counter if sent simultaneously, potentially allowing…

feature[ZBXNEXT-10478] updated maximum supported MariaDB version to 12.3 (mprihodko)

feature[ZBXNEXT-10211] updated alarm discovery in vmware template (abakaldin)

feature[ZBXNEXT-10611] added real host name for native vmware.*.alarms.get item keys (MVekslers)

feature[ZBXNEXT-10618] updated maximum supported TimescaleDB version to 2.27 (mprihodko)

feature[ZBXNEXT-10592] updated maximum supported MySQL version to 9.7 (mprihodko)

fix[ZBX-28198] fixed redirection to invalid URL (dpankins)

fix[ZBX-28076] improved login handling (vbodrihins)

fix[ZBX-28074] fixed potential disclosure of some write-only fields through API filter and search parameters (dpankins)

fix[ZBX-28073] improved behavior of script HttpRequest call (MVekslers)

fix[ZBX-28072] fixed maximum validation limit per request in validate.api.exists (uolekss)

fix[ZBX-27495] fixed excessive history upload delay for both Zabbix agents (vsmelovs)

fix[ZBX-27883] fixed inability to copy prototypes that depend on same trigger prototype when cloning template or host (vmaksimovs)

fix[ZBX-27065] fixed JavaScript error when closing standalone edit form with inline validation that performs server side checks (vmurzins)

fix[ZBX-27900] fixed Windows job handle not being closed on Zabbix agent 2 (esneiders)

fix[ZBX-27594] fixed sorting of discovered hosts (msnihach)

fix[ZBX-27770] fixed validation of HTTP response data for scenario-level dynamic variables in web monitoring (sboidenko)

fix[ZBX-27561] mitigated recurring system errors when editing groups for users or hosts in parallel API requests (kkuzmina, mprihodko)

fix[ZBX-26766] fixed code error when updating host, template, or user groups with duplicate group set entries (jfreibergs)

fix[ZBX-27355] added checkbox toggle behavior on label click in graph prototype popup (msnihach)

fix[ZBX-27382] fixed incorrect tag-based service permission check (averza)

fix[ZBX-27200] fixed invalid statuses for hosts and services during network discovery when host is found on several IP addresses (aetatsu)

fix[ZBX-27144] fixed legend text clipping at bottom of downloaded widget images (aluchko)

fix[ZBX-27732] fixed auto refresh to continue running in Latest data view (uolekss)

fix[ZBX-26048] fixed long error title visibility in frontend modal window (isharha)

fix[ZBX-26788] fixed duplicate announcement of month and year in datepicker for assistive technologies (aluchko)

fix[ZBX-25461] fixed contrast problems with severity icons in high-contrast themes (kastafjevs)

fix[ZBX-24054] fixed template cloning with extended amount of mappings (gklavins)

fix[ZBX-27698] fixed Clock widget "Server time" displaying same time as browser local time (aluchko)

fix[ZBX-27103] fixed incorrect label color contrast for Item value widget in dark theme (aluchko)

fix[ZBX-27777] fixed dashboard widget decimals for Azure SQL Managed Instance by HTTP template (kbruvers)

fix[ZBX-27809] fixed QR code generation by using integer pixel alignment to eliminate module distortion (gberzina)

fix[ZBX-27510] fixed Geomap widget not resizing map on container resize (averza)

7.4.11 Jun 2, 2026 Release notes ↗

securityFixes CVE-2026-23933: In Zabbix 7.4 the cryptographic key used for signing Frontend sessions has been erroneously written to the database seed. Currently the only known exploitation scenario is for deployments that util…

securityFixes CVE-2026-23930: An unauthenticated user is able to cause disproportionate CPU load on the Frontend webserver by sending specifically crafted requests to the Frontend popup.testtriggerexpr action, leading to potent…

securityFixes CVE-2026-23938: An authenticated administrator is able to crash Zabbix server or proxy by creating specifically crafted preprocessing/script item JavaScript scripts, leading to potential denial of service.

securityFixes CVE-2026-23931: The frontend validatate.api.exists action can be exploited by authenticated users to extract plaintext user macro values leading to potential loss of confidentiality.

fix[ZBX-27832] fixed changelog not being flushed (vso)

7.4.10 May 6, 2026 Release notes ↗

feature[ZBXNEXT-9722] added authentication macros to Redis by Zabbix agent 2 template (smansurovs)

feature[ZBXNEXT-10502] added support for native connection mode in Ceph by Zabbix agent 2 template (abakaldin)

feature[ZBXNEXT-10211] added info about VMware entities to alarm JSON and ifbackingnetwork info to JSON for *vm.discovery and *vm.net.if.discovery items (MVekslers)

fix[ZBX-27496] improved network discovery subsystem to work with snmpv1 and snmpv2c checks (MVekslers)

fix[ZBX-27592] fixed memory items becoming unsupported in Apache templates (kflorowski)

fix[ZBX-27635] fixed Zabbix server and proxy build without libcurl (arimdjonoks)

fix[ZBX-27463] replaced 'New oauth' with 'New OAuth' in Media Type edit form (dpankins)

fix[ZBX-17971] fixed macro view in trigger descriptions in some SNMP templates (abrosimovs)

fix[ZBX-27610] fixed http agent item user macros not resolving in required status codes (kastafjevs)

fix[ZBX-27559] fixed inline validation error display for "Inherited and host macros" section in host and template forms (gberzina)

fix[ZBX-27671] updated Proxmox template (abakaldin)

fix[ZBX-26388] improved memory usage monitoring for Docker by Zabbix agent 2 template (smansurovs)

fix[ZBX-26903] fixed zabbix.stats log spam (sboidenko)

fix[ZBX-27115] fixed some ODBC errors not being processed (mkorotkov)

fix[ZBX-27025] fixed incorrect header parsing in JS files (kflorowski)

fix[ZBX-26615] fixed inconsistent parameter types in Zabbix configuration file (Ivo)

fix[ZBX-27484] fixed displaying position of error messages for empty query, item parameter, and header name fields, removed redundant error messages for empty fields for custom intervals (msnihach)

fix[ZBX-27485] fixed issue with disabled toggling and readonly attributes in "Access to API" section (msnihach)

fix[ZBX-27418] fixed "disk failed" status in HPE Primera by HTTP template (smansurovs)

fix[ZBX-27611] reduced received data size for Elasticsearch template (kflorowski)

fix[ZBX-27552] fixed macro descriptions in Azure template (kflorowski)

fix[ZBX-27609] fixed updating item colors when items are reordered in graph edit form (gberzina)

fix[ZBX-27569] fixed broadcasting of item in Item history widget (dfofanovs)

fix[ZBX-27679] fixed missing translation reporting in JavaScript; added missing translations (averza)

fix[ZBX-27392] fixed selected count staying unchanged when trigger is deleted (gklavins)

7.4.9 Apr 8, 2026 Release notes ↗

securityFixes CVE-2026-23929: Prototype pollution vulnerability in searchParamsToObject() is leading to a persistent XSS in Maps. URL parameter processing was not filtering dangerous properties like __proto__, combined with jQu…

securityFixes CVE-2026-23922: The email media OAuth field 'Client secret' cannot be read after saving, but a Super Admin can leak it by setting a malicious 'Token endpoint'. Changes were made to reset the client secret upon cha…

feature[ZBXNEXT-10121] added support for PHP 8.5 (talbergs)

feature[ZBXNEXT-10553] updated maximum supported TimescaleDB version to 2.26 (mprihodko)

feature[ZBXNEXT-10448] updated maximum supported MySQL version to 9.6 (mprihodko)

feature[ZBXNEXT-10422] added Cradlepoint NCM v2 by HTTP and Cradlepoint NCM v2 device by HTTP templates (aiantsen)

feature[ZBXNEXT-9961] added webhook for IBM Maximo service request creation (abrosimovs)

feature[ZBXNEXT-10477] updated maximum supported MariaDB version to 12.2 (mprihodko)

feature[ZBXNEXT-10403] implemented template for Huawei AR600 devices (kflorowski)

fix[ZBX-28068] fixed property name handling in JavaScript objects (averza)

fix[ZBX-28067] fixed OAuth client secret not being reset on OAuth token URL change (isharha)

fix[ZBX-27662] renamed GLPI media type (mruszczyk)

fix[ZBX-27542] fixed memory leak in Zabbix Agent 2 scheduler (mkorotkov)

fix[ZBX-27179] fixed incorrect man page for Zabbix agent 2 (dbriedis)

fix[ZBX-26341] fixed hint-box disappearing on refresh in problems (gklavins)

fix[ZBX-27274] fixed existing record inline validation to work with IDs over int32 (gberzina)

fix[ZBX-27044] fixed inconsistent focus and selection of primary fields in forms (averza)

fix[ZBX-26820] fixed eventid error after clicking Update problem on Trigger overview widget (aluchko)

fix[ZBX-27056] enabled displaying setting links in top drop-down menu for custom UI modules (aluchko)

fix[ZBX-27582] fixed history syncer being blocked when checking if new timers are added or updated (vso)

fix[ZBX-27147] added RESTful API v2 support with OAuth2 and updated endpoints in GLPi media type (mruszczyk)

fix[ZBX-27626] fixed crash during configuration sync after removing prototype trigger with non-prototype item (wiper)

fix[ZBX-26128] fixed sort order for problem and event acknowledgements to use ID for same timestamp records (gberzina, rgontarski)

fix[ZBX-27123] changed redirect page after deleting graph prototype to same graph prototype's list page (msnihach)

fix[ZBX-27108] fixed issue where graph time selector caused full page refresh and lost current pagination (msnihach)

fix[ZBX-27058] fixed unsupported items in HPE iLO by HTTP (kflorowski)

fix[ZBX-26799] adjusted OAuth token field behavior in Media type configuration form when access token update time exceeds current Unix timestamp (kkuzmina)

fix[ZBX-27306] added optional upgrade patch to ensure that web scenario item tags correspond to web scenario tags (arimdjonoks)

fix[ZBX-27584] improved configuration sync performance on Zabbix proxy by deleting in batches (vso)

fix[ZBX-25988] fixed problem with multiple columns being created on column create in widgets (wczerneha)

fix[ZBX-26931] fixed service list to display inaccessible service error when opening or refreshing list of deleted services (gberzina)

fix[ZBX-27312] fixed issue of Zabbix agent 2 sometimes returning wrong result for proc.num (arimdjonoks)

fix[ZBX-26459] fixed host macros view to avoid displaying both macro types when switching quickly (gberzina)

fix[ZBX-27416] fixed message box display bug in Monitoring > Problems page (gberzina)

fix[ZBX-26899] fixed yaml markings for import compare (gberzina)

fix[ZBX-27467] fixed host name error message in Host Wizard (gberzina)

fix[ZBX-26979] fixed issue causing empty error message when adding new template group to template, updated inline validation for template groups and host group fields (msnihach)

fix[ZBX-26542] fixed max period calculation method for graphs in parameter validation for allowed period (msnihach)

fix[ZBX-26633] changed Host Wizard agent port validation to accept values from 1024 to 32767 (aluchko)

7.4.8 Mar 13, 2026 Release notes ↗

securityFixes CVE-2026-23928: The Item history widget (in Zabbix 7.0+) or the Plain text widget (in Zabbix 6.0) can execute injected JavaScript when HTML display is enabled. This can allow an attacker to perform unauthorized ac…

securityFixes CVE-2026-23926: An authenticated (non-super) administrator can create a maintenance period with a JavaScript payload that is executed by any user that opens tooltip for that maintenance period in the Host navigato…

securityFixes CVE-2026-23927: A user able to connect to Agent 2 can inject an Oracle TNS connection string via the 'service' parameter. This can lead to Agent 2 connecting to an attacker-controlled server and leaking Oracle dat…

fix[ZBX-27590] reverted the custom-on-fail discard value behavior so that it now correctly discards the value instead of resetting the error state and recalculating dependent items (vso)

fix[ZBX-26579] added possibility to switch SSO user on internal login failures (jfreibergs)

7.4.7 Feb 13, 2026 Release notes ↗

securityFixes CVE-2026-23923: An unauthenticated attacker can exploit the Frontend 'validate' action to blindly instantiate arbitrary PHP classes. The impact depends on environment setup but appears limited at this time.

securityFixes CVE-2026-23924: Zabbix Agent 2 Docker plugin does not properly sanitize the 'docker.container_info' parameters when forwarding them to the Docker daemon. An attacker capable of invoking Agent 2 can read arbitrary…

fix[ZBX-27508] fixed inline validation rules for item and item prototype forms (gberzina)

7.4.6 Dec 18, 2025 Release notes ↗

securityFixes CVE-2026-23921: A low privilege Zabbix user with API access can exploit a blind SQL injection vulnerability in include/classes/api/CApiService.php to execute arbitrary SQL selects via the sortfield parameter. Alth…

securityFixes CVE-2026-23920: Host and event action script input is validated with a regex (set by the administrator), but the validation runs in multiline mode. If ^ and $ anchors are used in user input validation, an injected…

fix[ZBX-27639] fixed regexp input validation to match whole input instead of per line match (askolmeisters)

7.4.5 Oct 31, 2025 Release notes ↗

fix[ZBX-27153] fixed undefined index error in SVG graphs for Zabbix agent active items (gcalenko)

fix[ZBX-27156] fix CPU spike in Zabbix agent 2 mysql plugin (esneiders)

7.4.4 Oct 29, 2025 Release notes ↗

feature[ZBXNEXT-10271] updated maximum supported TimescaleDB version to 2.22 (mprihodko)

feature[ZBXNEXT-10245] added Stormshield SNS by SNMP template (knaglis)

feature[ZBXNEXT-10219] updated maximum supported PostgreSQL version to 18 (mprihodko)

feature[ZBXNEXT-7744] added TLS support for Zabbix agent 2 Redis plugin (opucka)

fix[ZBX-27113] improved performance and memory usage by not storing item unsupported error in configuration cache (vso)

fix[ZBX-27111] fixed new timer being allocated each time trigger value is updated (vso)

fix[ZBX-26544] added preprocessing step to "Outbound packets discarded" item in FortiGate by SNMP template (aiantsen)

fix[ZBX-22157] added Map navigation tree widget problem filtering using "Problem display" and "Show suppressed problems" filters of map settings (dfofanovs)

fix[ZBX-27059] fixed conditions for "Cannot delete default MFA method" check (dpankins)

fix[ZBX-26818] fixed crash on \"cannot get secrets for path\" error due to missing lock when using shared memory (vso)

fix[ZBX-26548] fixed checkbox state for host object lists (gklavins, wczerneha)

fix[ZBX-24504] improved Prometheus to JSON preprocessing step performance when reused with similar parameters in dependent items (wiper)

fix[ZBX-26069] implemented re-broadcast behavior for widgets on forced update (ashubin, wczerneha)

fix[ZBX-25743] fixed broken item selection list in Firefox (gklavins, wczerneha)

fix[ZBX-27055] fixed multiple confirmation requests when a popup was opened from another popup (averza)

fix[ZBX-25148] added adjustments for sequential data entries with the same timestamp (askolmeisters)

fix[ZBX-26501] changed the query responsible for retrieving macros from host, template, and host prototype (rgontarski)

fix[ZBX-25394] fixed unassigned proxy indication on Queue details page; extended coverage to proxies managed by proxy groups (dpankins)

fix[ZBX-26795] fixed unnecessary setting revision change (askolmeisters)

fix[ZBX-25263] fixed Zabbix agent to attempt next refresh of active checks in 60 seconds in case of connection errors (arimdjonoks)

fix[ZBX-26910] fixed Zabbix server compilation on macOS or with custom library paths (vso)

fix[ZBX-24046] fixed incorrect error message for ldap_jit_interval field in LDAP settings form (kkuzmina)

fix[ZBX-25741] eliminated difference in host group lists via "Select" button and via search typing (wczerneha)

fix[ZBX-26893] fixed delay when executing tasks through Zabbix proxy such as test item, check now, remote command (vso)

fix[ZBX-26941] fixed duplicate entry error when new value arrive after Zabbix server finished syncing trends (vso)

fix[ZBX-26776] fixed ability to change widget in Pie chart widget data set (gberzina)

fix[ZBX-22625] fixed JavaScript in HPE Synergy by HTTP template (abrosimovs)

fix[ZBX-24918] fixed crashes of Zabbix agent 2 for Windows related to PDH perf_counter (opucka)

fix[ZBX-26755] fixed problem with Zabbix agent 2 MQTT plugin not establishing connection if first call failed (opucka)

fix[ZBX-16162] fixed classic graphs rendering when throttling is used (Sasha)

fix[ZBX-25038] fixed SCIM error message by adding mention of requested endpoint to it (kkuzmina)

fix[ZBX-26851] changed macro names in MSSQL templates (sbelakovs)

fix[ZBX-26882] fixed incorrect validation error when new dataset is added in Graph widget (gklavins)

7.4.3 Sep 30, 2025 Release notes ↗

securityFixes CVE-2026-23919: For performance reasons Zabbix Server/Proxy reuses JavaScript (Duktape) contexts (used in script items, JavaScript reprocessing, Webhooks). This can lead to confidentiality loss where a regular (no…

feature[ZBXNEXT-10143] added "Highlight whole row" feature in non-compact mode in Problems (ashubin)

feature[ZBXNEXT-10106] extended preprocessor throughput monitoring in Zabbix server/proxy health templates (aiantsen)

feature[ZBXNEXT-9819] added new template Vyatta Virtual Router by SNMP (knaglis)

feature[ZBXNEXT-9933] added TNS name support for Zabbix agent 2 Oracle plugin (lsurvilo)

feature[ZBXNEXT-10107] improved device coverage in Huawei OceanStor Dorado by SNMP template (abrosimovs)

feature[ZBXNEXT-10123] added Aruba CX 8300s by SNMP template (akotsegubov)

feature[ZBXNEXT-10112] added PSK identity pre-fill for Host Wizard (gklavins)

feature[ZBXNEXT-10152] added new macro for disk discovery type selection in both SMART by Zabbix agent 2 templates (knaglis)

feature[ZBXNEXT-10027] prepared for removal of TimescaleDB API call deprecated since TimescaleDB 2.18.0 (jfreibergs)

feature[ZBXNEXT-10017] added Ciena 3906 by SNMP template (akotsegubov)

feature[ZBXNEXT-9255] updated Meraki templates to handle rate limit on API requests (aiantsen)

feature[ZBXNEXT-9902] changed timeout range for Zabbix JS and Zabbix get utilities (askolmeisters)

feature[ZBXNEXT-10077] updated maximum supported MariaDB version to 12.0 (mprihodko)

fix[ZBX-25103] replaced legacy hintbox generation for trigger operational data with current (dpankins)

fix[ZBX-25796] fixed confusing error message on item test timeout (isharha)

fix[ZBX-26419] improved performance of problem and event views by optimizing SQL queries to join only necessary triggers, eliminating redundant post-join filtering (vso)

fix[ZBX-26337] removed unnecessary div elements for entries without problems in Item and Host navigator widgets (msnihach)

fix[ZBX-26873] fixed support for SSH item proxy through configurations in SSH configuration file (aetatsu)

fix[ZBX-19267] fixed wmi.get items sometimes incorrectly returning "Empty WMI search result" with Zabbix agent 2 (aetatsu)

fix[ZBX-20207] fixed unexpected interface connection mode change during autoregistration (vso)

fix[ZBX-26908] added Zabbix agent compile profile with proper options for Solaris 11 (aetatsu)

fix[ZBX-25795] fixed shapes not being displayed on maps (gklavins)

fix[ZBX-25448] fixed token-based authentication method in FortiGate by HTTP template (egordymov)

fix[ZBX-26847] explicitly defined Oracle connection timezone in Zabbix agent 2 (opucka)

fix[ZBX-26472] fixed clearing of elements when imported file contains no background image or icon map (rgontarski)

fix[ZBX-26611] changed misleading label "Metrics" in Item card widget to "Interval and storage" (rgontarski)

fix[ZBX-26644] fixed ability to see info icons for no longer discovered LLD rules in list of host LLD rules (gberzina)

fix[ZBX-26694] fixed media type test parameter maxlength (gberzina)

fix[ZBX-26416] fixed SNMP trap item processing issue after monitored host changes (sboidenko)

fix[ZBX-26909] fixed crash on HA node recovery after standby with Zabbix proxy (sboidenko)

fix[ZBX-20964] removed Problems link in Monitoring hosts page for user who does not have access (msnihach)

fix[ZBX-26621] added TLS host parameter update in autoregistration mode (vsmelovs)

fix[ZBX-26440] fixed inability to update JMX endpoint field in item, item prototype, and LLD forms (kkuzmina)

fix[ZBX-25041] improved configuration form validation in Graph and Pie chart widgets when referenced item widget is unavailable (isharha)

fix[ZBX-24720] fixed LDAP media type mapping "When active" field trimming (dpankins)

fix[ZBX-26892] fixed VMware Event Collector hangs in case of network errors (MVekslers)

fix[ZBX-26212] fixed different types of errors that occurred inconsistently for Tags and Macros fields (msnihach)

fix[ZBX-26732] improved partial configuration sync performance on Zabbix proxy by eliminating inefficient SELECT queries involving large ID lists (vso)

fix[ZBX-26920] fixed wrong time in Zabbix agent for Windows (sboidenko)

+27 more items in the release notes

7.4.2 Aug 25, 2025 Release notes ↗

securityFixes CVE-2026-23925: An authenticated Zabbix user (User role) with template/host write permissions is able to create objects via the configuration.import API. This can lead to confidentiality loss by creating unauthori…

securityFixes CVE-2025-27231: The LDAP 'Bind password' value cannot be read after saving, but a Super Admin account can leak it by changing LDAP 'Host' to a rogue LDAP server. To mitigate this, the 'Bind password' value is now…

securityFixes CVE-2025-49641: A regular Zabbix user with no permission to the Monitoring -> Problems view is still able to call the problem.view.refresh action and therefore still retrieve a list of active problems.

fix[ZBX-26868] fixed crash when adding new SNMP device (vso)

7.4.1 Jul 30, 2025 Release notes ↗

feature[ZBXNEXT-10122] updated maximum supported TimescaleDB version to 2.21 (mprihodko)

feature[ZBXNEXT-10119] improved preprocessing diagnostics by highlighting top item IDs with the longest processing times (vso)

feature[ZBXNEXT-9770] prepared for removal of TimescaleDB API calls deprecated since TimescaleDB 2.18.0 (mprihodko)

feature[ZBXNEXT-9959] added Cisco Secure Firewall Threat Defense by HTTP template (egordymov)

feature[ZBXNEXT-9926] added a new self-test item and improved self-test trigger for both SMART by Zabbix agent 2 templates (knaglis)

feature[ZBXNEXT-10018] updated maximum supported TimescaleDB version to 2.20 (mprihodko)

feature[ZBXNEXT-9674] added AssumeRole usage with metadata authentication for AWS templates (egordymov)

feature[ZBXNEXT-9931] added top items sorted by received values number and size to diaginfo preprocessing section (asestakovs)

fix[ZBX-26697] fixed memory error in sender when trying to read invalid response (dgoloscapov)

fix[ZBX-26717] fixed undefined index on agent installation step in Host Wizard (vmurzins)

fix[ZBX-26645] fixed lost resource handling in LLD prototype discovery (wiper)

fix[ZBX-26693] fixed item values without preprocessing to skip preprocessing manager (vso)

fix[ZBX-26680] fixed space character escaping in agent installation script in Host Wizard (vmurzins)

fix[ZBX-26625] fixed server status verification logic in system information and footer warning message (vmurzins)

fix[ZBX-26614] fixed Host Wizard template selection step for Safari (ashubin)

fix[ZBX-26374] added updates for displaying the relevant monitoring data or "no permissions" notification for the Classic Graph widget (msnihach)

fix[ZBX-26651] fixed LLD rules getting recreated during import (jfreibergs)

fix[ZBX-26661] fixed deadlock on autoreg_host table (vso)

fix[ZBX-26675] fixed validation for proxy field on discovered host (vmurzins)

fix[ZBX-26247] added rounding for Y axis min/max value (msnihach)

fix[ZBX-26524] fixed threads to terminate gracefully when child process exits unexpectedly to avoid deadlocks (vso)

fix[ZBX-26439] prevented data integrity loss caused by simultaneous API change request execution (vmaksimovs)

fix[ZBX-26082] fixed agent2 and proxy redirection bug related to incorrect IPv6 string format (vsmelovs)

fix[ZBX-26486] fixed errors in Zabbix server log on second and subsequent server starts with TimescaleDB (mprihodko)

fix[ZBX-25958] fixed incorrect dependency hosts format in trigger form (esekace)

fix[ZBX-25545] fixed host interface duplication in autoregistration mode (vsmelovs)

fix[ZBX-26436] prevented redundant row locks in the database when deleting hosts in parallel API requests (vmaksimovs)

fix[ZBX-26528] fixed improper handling of long or corrupted ODBC error messages (dgoloscapov)

fix[ZBX-26495] added parameter support for database down script media type (askolmeisters)

fix[ZBX-25313] added boot time item to VMware Guest template (akotsegubov)

fix[ZBX-26370] fixed HA node recovery after standby, free id cache (sboidenko)

fix[ZBX-25859] fixed connection reuse for Elasticsearch (rtrizna)

fix[ZBX-26591] fixed detection of read-only state in PostgreSQL replicated database (sboidenko)

fix[ZBX-26230] added missing namespace filter to Prometheus preprocessing of pod metrics in Kubernetes cluster state by HTTP template (drasikhov)

fix[ZBX-24674] updated filesystem discovery low space trigger prototype override in F5 Big-IP by SNMP template (drasikhov)

fix[ZBX-26444] fixed swap utilization trigger recovery expression in F5 Big-IP by SNMP template (drasikhov)

fix[ZBX-22770] added self_test_in_progress tag for Zabbix agent 2 S.M.A.R.T plugin (lsurvilo)

fix[ZBX-23216] added application token support in GLPi media type, updated documentation; removed Zammad mentions from non-related media types (drasikhov)

fix[ZBX-26484] fixed event tags verification in Telegram media type to be checked only for supported event sources (drasikhov)

fix[ZBX-22022] removed client certificate expiration histogram metrics from Kubernetes API server by HTTP template (drasikhov)

+36 more items in the release notes

7.4.0 Jun 30, 2025 Release notes ↗

fix[ZBX-26564] fixed rare case when modified widget configuration is not applied (averza)

fix[ZBX-26527] fixed access to server status information for users of non-super admin roles (talbergs)

fix[ZBX-26517] disabled discovered item prototype's popup menu entries for creating trigger or dependent item prototype (wczerneha)

fix[ZBX-26523] added support for mass update of trigger prototypes with LLD rule prototype as parent (wczerneha)

fix[ZBX-26512] removed unnecessary button from the discovery prototype form (wczerneha)

fix[ZBX-26530] fixed notices when accessing prototype pages while not logged in (jfreibergs)

7.0.32 Oct 20, 2026 Release notes ↗

feature[ZBXNEXT-10786] updated maximum supported TimescaleDB version to 2.30 (mprihodko)

fix[ZBX-27897] fixed time function triggers not working after disabling and enabling item (wiper)

fix[ZBX-26854] fixed handling of null as previous value in preprocessing during item test (vskalbins)

fix[ZBX-23109] fixed automatic setting of SNMP maximum repetition count and community on SNMP version change for host interface (gberzina)

fix[ZBX-27925] added AI_NUMERICHOST flag to suppress potentially lengthy network host address lookups (jburlakovs)