Zabbix 7.0.26 → 7.0.27

1 release · 0 breaking changes · 2 security fixes · 2 advisories fixed

2security0breaking0deprecated0feature19fix

Is 7.0.26 affected? · What changed up to 8.0.0

Vulnerabilities fixed by this upgrade

4.9 CVE-2026-23938 An authenticated administrator is able to crash Zabbix server or proxy by creating specifically crafted preprocessing/script item JavaScript scripts, leading to potential denial of service.
7.5 CVE-2026-23930 An unauthenticated user is able to cause disproportionate CPU load on the Frontend webserver by sending specifically crafted requests to the Frontend popup.testtriggerexpr action, leading to potent…

Breaking changes

None in the release notes.

Security changes

security Fixes CVE-2026-23930: An unauthenticated user is able to cause disproportionate CPU load on the Frontend webserver by sending specifically crafted requests to the Frontend popup.testtriggerexpr action, leading to potent… in 7.0.27
security Fixes CVE-2026-23938: An authenticated administrator is able to crash Zabbix server or proxy by creating specifically crafted preprocessing/script item JavaScript scripts, leading to potential denial of service. in 7.0.27

Every release in between

7.0.27 Jun 2, 2026 Release notes ↗

securityFixes CVE-2026-23930: An unauthenticated user is able to cause disproportionate CPU load on the Frontend webserver by sending specifically crafted requests to the Frontend popup.testtriggerexpr action, leading to potent…

securityFixes CVE-2026-23938: An authenticated administrator is able to crash Zabbix server or proxy by creating specifically crafted preprocessing/script item JavaScript scripts, leading to potential denial of service.

fix[ZBX-28075] fixed potential type mismatch in JS exception handling (MVekslers)

fix[ZBX-22504] improved memory usage in LLD worker processes with large low-level discovery (vso)

fix[ZBX-27780] restored support of LLD macros in LLD rule override operations Update interval, History, and Trends (dpankins)

fix[ZBX-27736] fixed no_data trigger flickering into unknown state for unsupported items (arimdjonoks)

fix[ZBX-27708] fixed error being displayed instead of graph for graphs with maximum height (kastafjevs)

fix[ZBX-27304] fixed missing gap between tag badges when widget overlay dialog is open (isharha)

fix[ZBX-25509] fixed z-select re-rendering after sorting (dpankins)

fix[ZBX-27210] fixed infinite loading on widgets after removing maps from Map Navigation Tree widget (aluchko)

fix[ZBX-27694] updated dependent item key from vm.memory.utilization to vm.memory.util in Linux by Zabbix agent active and passive templates (smansurovs)

fix[ZBX-27399] fixed possible deadlocks in configuration cache sync (sboidenko)

fix[ZBX-27675] improved configuration syncer not to reserve large amounts of memory (vso)

fix[ZBX-27475] fixed typo in Mattermost webhook "fallback" field name (smansurovs)

fix[ZBX-26742] fixed text overlap in pop-ups for Portuguese (gklavins)

fix[ZBX-27632] fixed trigger severity checkboxes update to checked state after validation error (kastafjevs)

fix[ZBX-27022] fixed preprocessing step "Discard unchanged" for string types (Andris, askolmeisters)

fix[ZBX-27688] removed checks to prevent bulk enabling of Gmail and Office 365 media types with incomplete configuration (aluchko)

fix[ZBX-27652] fixed incorrect documentation link for Administration/General/Other (aluchko)

fix[ZBX-27517] fixed "page not found" issue when exporting template that contains inaccessible dashboard element (aluchko)

fix[ZBX-27121] fixed issue where repeatedly clicking Close button on notifications floating pop-up caused error (msnihach)