Zabbix 7.0.25 → 7.0.28

3 releases · 0 breaking changes · 5 security fixes · 5 advisories fixed

5security0breaking0deprecated8feature54fix

Is 7.0.25 affected? · What changed up to 8.0.0

Vulnerabilities fixed by this upgrade

4.9 CVE-2026-23938 An authenticated administrator is able to crash Zabbix server or proxy by creating specifically crafted preprocessing/script item JavaScript scripts, leading to potential denial of service.
7.5 CVE-2026-23930 An unauthenticated user is able to cause disproportionate CPU load on the Frontend webserver by sending specifically crafted requests to the Frontend popup.testtriggerexpr action, leading to potent…
4.9 CVE-2026-23935 A Zabbix administrator is able to read out of bounds memory by utilizing a flaw in script item/preprocessing (JavaScript) HttpRequest logic, leading to potential confidentiality loss.
6.5 CVE-2026-23937 The Zabbix API host.get action can be exploited by authenticated users to extract a host's PSK key leading to potential loss of data integrity.
3.7 CVE-2026-1199 Zabbix API and Frontend login lockout mechanism has a flaw where several unsuccessful login requests are not properly counted towards the block counter if sent simultaneously, potentially allowing…

Breaking changes

None in the release notes.

Security changes

security Fixes CVE-2026-23937: The Zabbix API host.get action can be exploited by authenticated users to extract a host's PSK key leading to potential loss of data integrity. in 7.0.28
security Fixes CVE-2026-23935: A Zabbix administrator is able to read out of bounds memory by utilizing a flaw in script item/preprocessing (JavaScript) HttpRequest logic, leading to potential confidentiality loss. in 7.0.28
security Fixes CVE-2026-1199: Zabbix API and Frontend login lockout mechanism has a flaw where several unsuccessful login requests are not properly counted towards the block counter if sent simultaneously, potentially allowing… in 7.0.28
security Fixes CVE-2026-23930: An unauthenticated user is able to cause disproportionate CPU load on the Frontend webserver by sending specifically crafted requests to the Frontend popup.testtriggerexpr action, leading to potent… in 7.0.27
security Fixes CVE-2026-23938: An authenticated administrator is able to crash Zabbix server or proxy by creating specifically crafted preprocessing/script item JavaScript scripts, leading to potential denial of service. in 7.0.27

Every release in between

7.0.28 Jul 7, 2026 Release notes ↗

securityFixes CVE-2026-23937: The Zabbix API host.get action can be exploited by authenticated users to extract a host's PSK key leading to potential loss of data integrity.

securityFixes CVE-2026-23935: A Zabbix administrator is able to read out of bounds memory by utilizing a flaw in script item/preprocessing (JavaScript) HttpRequest logic, leading to potential confidentiality loss.

securityFixes CVE-2026-1199: Zabbix API and Frontend login lockout mechanism has a flaw where several unsuccessful login requests are not properly counted towards the block counter if sent simultaneously, potentially allowing…

feature[ZBXNEXT-10478] updated maximum supported MariaDB version to 12.3 (mprihodko)

feature[ZBXNEXT-10211] updated alarm discovery in vmware template (abakaldin)

feature[ZBXNEXT-10611] added real host name for native vmware.*.alarms.get item keys (MVekslers)

feature[ZBXNEXT-10618] updated maximum supported TimescaleDB version to 2.27 (mprihodko)

feature[ZBXNEXT-10592] updated maximum supported MySQL version to 9.7 (mprihodko)

fix[ZBX-28076] improved login handling (vbodrihins)

fix[ZBX-28074] fixed potential disclosure of some write-only fields through API filter and search parameters (dpankins)

fix[ZBX-28073] improved behavior of script HttpRequest call (MVekslers)

fix[ZBX-27495] fixed excessive history upload delay for both Zabbix agents (vsmelovs)

fix[ZBX-27883] fixed inability to copy trigger prototypes that depend on same trigger prototype when cloning template or host (vmaksimovs)

fix[ZBX-27900] fixed Windows job handle not being closed on Zabbix agent 2 (esneiders)

fix[ZBX-27594] fixed sorting of discovered hosts (msnihach)

fix[ZBX-27770] fixed validation of HTTP response data for scenario-level dynamic variables in web monitoring (sboidenko)

fix[ZBX-27561] mitigated recurring system errors when editing groups for users or hosts in parallel API requests (kkuzmina, mprihodko)

fix[ZBX-26766] fixed code error when updating host, template, or user groups with duplicate group set entries (jfreibergs)

fix[ZBX-27382] fixed incorrect tag-based service permission check (averza)

fix[ZBX-27200] fixed invalid statuses for hosts and services during network discovery when host is found on several IP addresses (aetatsu)

fix[ZBX-27144] fixed legend text clipping at bottom of downloaded widget images (aluchko)

fix[ZBX-27732] fixed auto refresh to continue running in Latest data view (uolekss)

fix[ZBX-26048] fixed long error title visibility in frontend modal window (isharha)

fix[ZBX-25461] fixed contrast problems with severity icons in high-contrast themes (kastafjevs)

fix[ZBX-26788] fixed duplicate announcement of month and year in datepicker for assistive technologies (aluchko)

fix[ZBX-27777] fixed dashboard widget decimals for Azure SQL Managed Instance by HTTP template (kbruvers)

fix[ZBX-27698] fixed Clock widget "Server time" displaying same time as browser local time (aluchko)

fix[ZBX-24054] fixed template cloning with extended amount of mappings (gklavins)

fix[ZBX-27809] fixed QR code generation by using integer pixel alignment to eliminate module distortion (gberzina)

fix[ZBX-27510] fixed Geomap widget not resizing map on container resize (averza)

7.0.27 Jun 2, 2026 Release notes ↗

securityFixes CVE-2026-23930: An unauthenticated user is able to cause disproportionate CPU load on the Frontend webserver by sending specifically crafted requests to the Frontend popup.testtriggerexpr action, leading to potent…

securityFixes CVE-2026-23938: An authenticated administrator is able to crash Zabbix server or proxy by creating specifically crafted preprocessing/script item JavaScript scripts, leading to potential denial of service.

fix[ZBX-28075] fixed potential type mismatch in JS exception handling (MVekslers)

fix[ZBX-22504] improved memory usage in LLD worker processes with large low-level discovery (vso)

fix[ZBX-27780] restored support of LLD macros in LLD rule override operations Update interval, History, and Trends (dpankins)

fix[ZBX-27736] fixed no_data trigger flickering into unknown state for unsupported items (arimdjonoks)

fix[ZBX-27708] fixed error being displayed instead of graph for graphs with maximum height (kastafjevs)

fix[ZBX-27304] fixed missing gap between tag badges when widget overlay dialog is open (isharha)

fix[ZBX-25509] fixed z-select re-rendering after sorting (dpankins)

fix[ZBX-27210] fixed infinite loading on widgets after removing maps from Map Navigation Tree widget (aluchko)

fix[ZBX-27694] updated dependent item key from vm.memory.utilization to vm.memory.util in Linux by Zabbix agent active and passive templates (smansurovs)

fix[ZBX-27399] fixed possible deadlocks in configuration cache sync (sboidenko)

fix[ZBX-27675] improved configuration syncer not to reserve large amounts of memory (vso)

fix[ZBX-27475] fixed typo in Mattermost webhook "fallback" field name (smansurovs)

fix[ZBX-26742] fixed text overlap in pop-ups for Portuguese (gklavins)

fix[ZBX-27632] fixed trigger severity checkboxes update to checked state after validation error (kastafjevs)

fix[ZBX-27022] fixed preprocessing step "Discard unchanged" for string types (Andris, askolmeisters)

fix[ZBX-27688] removed checks to prevent bulk enabling of Gmail and Office 365 media types with incomplete configuration (aluchko)

fix[ZBX-27652] fixed incorrect documentation link for Administration/General/Other (aluchko)

fix[ZBX-27517] fixed "page not found" issue when exporting template that contains inaccessible dashboard element (aluchko)

fix[ZBX-27121] fixed issue where repeatedly clicking Close button on notifications floating pop-up caused error (msnihach)

7.0.26 May 5, 2026 Release notes ↗

feature[ZBXNEXT-9722] added authentication macros to Redis by Zabbix agent 2 template (smansurovs)

feature[ZBXNEXT-10502] added support for native connection mode in Ceph by Zabbix agent 2 template (abakaldin)

feature[ZBXNEXT-10211] added info about VMware entities to alarm JSON and ifbackingnetwork info to JSON for *vm.discovery and *vm.net.if.discovery items (MVekslers)

fix[ZBX-27496] improved network discovery subsystem to work with snmpv1 and snmpv2c checks (MVekslers)

fix[ZBX-27635] fixed Zabbix server and proxy build without libcurl (arimdjonoks)

fix[ZBX-27592] fixed memory items becoming unsupported in Apache templates (kflorowski)

fix[ZBX-17971] fixed macro view in trigger descriptions in some SNMP templates (abrosimovs)

fix[ZBX-27610] fixed http agent item user macros not resolving in required status codes (kastafjevs)

fix[ZBX-26388] improved memory usage monitoring for Docker by Zabbix agent 2 template (smansurovs)

fix[ZBX-27115] fixed some ODBC errors not being processed (mkorotkov)

fix[ZBX-27025] fixed incorrect header parsing in JS files (kflorowski)

fix[ZBX-27485] fixed issue with disabled toggling and readonly attributes in "Access to API" section (msnihach)

fix[ZBX-27418] fixed "disk failed" status in HPE Primera by HTTP template (smansurovs)

fix[ZBX-27611] reduced received data size for Elasticsearch template (kflorowski)

fix[ZBX-27552] fixed macro descriptions in Azure template (kflorowski)

fix[ZBX-27569] fixed broadcasting of item in Item history widget (dfofanovs)