Zabbix 7.0.27 → 7.0.32

5 releases · 0 breaking changes · 4 security fixes · 4 advisories fixed

4security0breaking0deprecated10feature101fix

Is 7.0.27 affected? · What changed up to 8.0.0

Vulnerabilities fixed by this upgrade

7.8 CVE-2026-59781 When Zabbix Agent was installed on Windows into a custom installation directory, the installer did not verify whether the selected directory had secure access permissions. If the target directory a…
4.9 CVE-2026-23935 A Zabbix administrator is able to read out of bounds memory by utilizing a flaw in script item/preprocessing (JavaScript) HttpRequest logic, leading to potential confidentiality loss.
6.5 CVE-2026-23937 The Zabbix API host.get action can be exploited by authenticated users to extract a host's PSK key leading to potential loss of data integrity.
3.7 CVE-2026-1199 Zabbix API and Frontend login lockout mechanism has a flaw where several unsuccessful login requests are not properly counted towards the block counter if sent simultaneously, potentially allowing…

Breaking changes

None in the release notes.

Security changes

security Fixes CVE-2026-59781: When Zabbix Agent was installed on Windows into a custom installation directory, the installer did not verify whether the selected directory had secure access permissions. If the target directory a… in 7.0.29
security Fixes CVE-2026-23937: The Zabbix API host.get action can be exploited by authenticated users to extract a host's PSK key leading to potential loss of data integrity. in 7.0.28
security Fixes CVE-2026-23935: A Zabbix administrator is able to read out of bounds memory by utilizing a flaw in script item/preprocessing (JavaScript) HttpRequest logic, leading to potential confidentiality loss. in 7.0.28
security Fixes CVE-2026-1199: Zabbix API and Frontend login lockout mechanism has a flaw where several unsuccessful login requests are not properly counted towards the block counter if sent simultaneously, potentially allowing… in 7.0.28

Every release in between

7.0.32 Oct 20, 2026 Release notes ↗

feature[ZBXNEXT-10786] updated maximum supported TimescaleDB version to 2.30 (mprihodko)

fix[ZBX-27897] fixed time function triggers not working after disabling and enabling item (wiper)

fix[ZBX-26854] fixed handling of null as previous value in preprocessing during item test (vskalbins)

fix[ZBX-23109] fixed automatic setting of SNMP maximum repetition count and community on SNMP version change for host interface (gberzina)

fix[ZBX-27925] added AI_NUMERICHOST flag to suppress potentially lengthy network host address lookups (jburlakovs)

fix[ZBX-24844] added missing filters in EtherLike-MIB discovery (kflorowski)

fix[ZBX-27673] fixed browser item timeout (sboidenko)

fix[ZBX-27888] resumed VMware data collection after pause of more than 1 hour (MVekslers)

fix[ZBX-27778] fixed keyboard navigation to "Edit filter properties" button (aluchko)

fix[ZBX-27967] fixed remote script execution for hosts monitored by proxy group when EnabledGlobalScripts is disabled (scernisenko)

fix[ZBX-27803] implemented collecting history.get results by sub-periods when limit parameter is given to avoid full table scans (jfreibergs)

fix[ZBX-27909] fixed text area maximum length in host inventory (uolekss)

fix[ZBX-24729] fixed unreadable long unit names in SVG graph widget (aluchko)

fix[ZBX-27943] fixed web.page.* checks failing when server requests TLS renegotiation on Zabbix agent 2 (esneiders)

fix[ZBX-26359] fixed Smart plugin handling of smartctl exit statuses and fixed discovery not returning data if one drive failed (opucka)

fix[ZBX-27957] fixed color selection in Pie chart and SVG graph datasets when aggregation is used (dfofanovs)

fix[ZBX-27779] fixed misplacement of "Update" and "Save" buttons after switching filter tabs in Safari (gklavins)

fix[ZBX-27492] fixed unsupported state change error caused by missing host in geomap widget (gklavins)

fix[ZBX-26836] fixed crashes in alert, connector, IPMI, LLD and report managers during Zabbix server shutdown (ademidovs)

7.0.31 Sep 22, 2026 Release notes ↗

feature[ZBXNEXT-10451] added Zabbix agent 2 pprof profiler (opucka)

fix[ZBX-28110] fixed simple trigger hintbox closure in SVG graph (dfofanovs)

fix[ZBX-27793] fixed incorrect screen reader announcements for modal dialog windows (aluchko)

fix[ZBX-27857] fixed SVG graph widget legend min/max values for "all" approximation (kastafjevs)

fix[ZBX-26411] fixed report manager failing to send scheduled reports when media types had been renamed (rtrizna)

fix[ZBX-27631] fixed macro resolution in exported item names and tags (vsmelovs)

fix[ZBX-28002] fixed nodata() trigger from flapping into unknown state when 1) log history with only metadata is received 2) preprocessing discards history 3) only old entries outside nodata() period are received (arimdjonoks)

fix[ZBX-26929] fixed duplicate item names in GCP template (kflorowski)

fix[ZBX-27437] fixed incorrect housekeeping option validation (ademidovs)

fix[ZBX-27513] fixed runtime errors on PHP 8.5 (Ivo)

fix[ZBX-28060] implemented inaccessible value mapping label for value mapping in items and item prototypes depending on user permissions (scernisenko)

fix[ZBX-27976] fixed db.odbc.get and db.odbc.discovery database monitor items failing when the first statement in SQL query is not a SELECT (mkorotkov)

fix[ZBX-27860] fixed agent redirect loop in proxy groups when server goes offline (wiper)

fix[ZBX-25576] fixed bad URL issue in TOPdesk webhook (kflorowski)

fix[ZBX-23983] fixed typo in the trigger event name for the Generic Java JMX template (smansurovs)

fix[ZBX-28087] fixed README.md files for cloud templates (smansurovs)

fix[ZBX-26475] fixed error handling in configserver items in MongoDB template (kflorowski)

fix[ZBX-27924] fixed trigger recovery expression for Dell PowerEdge by HTTP templates (mruszczyk)

fix[ZBX-28065] fixed missing ellipsis for result field in the item testing form (scernisenko)

7.0.30 Aug 25, 2026 Release notes ↗

feature[ZBXNEXT-10720] updated maximum supported TimescaleDB version to 2.29 (mprihodko)

feature[ZBXNEXT-10732] updated help URL from the frontend to documentation (scernisenko)

fix[ZBX-27836] fixed PHP runtime errors in user role edit form (Ivo)

fix[ZBX-28045] fixed active checks in case of failed response on Zabbix agent 2 (aetatsu)

fix[ZBX-23057] fixed memory fragmentation trigger and added RSS overhead triggers in Redis by Zabbix agent 2 template (mruszczyk)

fix[ZBX-27746] removed unsupported discovery worker targets and preprocessing worker profiling targets from Zabbix server and proxy help messages and man pages (rtrizna)

fix[ZBX-27791] added multiplier to percent_used metric in Ceph by Zabbix agent 2 template (mruszczyk)

fix[ZBX-27646] removed MS Teams webhook in default data (egordymov)

fix[ZBX-25042] removed discard option for SNMP status items (kflorowski)

fix[ZBX-25663] added node name macro to RabbitMQ node templates (abrosimovs)

fix[ZBX-26229] fixed CPU user and idle time OIDs in Check Point NGFW SNMP template (mruszczyk)

fix[ZBX-27861] fixed correct shape form layout corruption in Safari on reopen (msnihach)

fix[ZBX-25608] fixed missing precision for temperature sensors for Cisco template (kflorowski)

fix[ZBX-22458] fixed cache hit ratio base typo in MSSQL by ODBC template (mruszczyk)

fix[ZBX-25484] fixed incorrect item configuration in default data (egordymov)

fix[ZBX-21236] improved metrics filtering in API response for the Elasticsearch Cluster by HTTP template (smansurovs)

fix[ZBX-24512] fixed memory items in Cisco Nexus 9000 Series by SNMP template (kflorowski)

fix[ZBX-24343] fixed temperature threshold trigger duplication for Cisco IOS by SNMP (kflorowski)

fix[ZBX-27893] fixed infinite loop for graphs in hosts monitoring when working time period in GUI is 00:00-24:00 (scernisenko)

fix[ZBX-27646] removed MS Teams webhook based on retired Office 365 Connector (mruszczyk)

fix[ZBX-27908] fixed icon mapping order for individual list item (scernisenko)

fix[ZBX-27920] fixed event menu entry parameters being marked as required when they are disabled (scernisenko)

fix[ZBX-25485] fixed language change to work for different environments (gberzina)

fix[ZBX-25815] removed mention of discovery from SNMP max_repetition help note (vskalbins)

fix[ZBX-27140] fixed overall hintbox positioning (dfofanovs)

7.0.29 Jul 28, 2026 Release notes ↗

securityFixes CVE-2026-59781: When Zabbix Agent was installed on Windows into a custom installation directory, the installer did not verify whether the selected directory had secure access permissions. If the target directory a…

feature[ZBXNEXT-10669] updated maximum supported TimescaleDB version to 2.28 (mprihodko)

fix[ZBX-28197] improved validation of SNMP trap payload in zabbix_trap_receiver.pl (MVekslers)

fix[ZBX-28196] added heartbeat connection type and frequency validation (sboidenko)

fix[ZBX-28195] implemented validation of parameters for jsrpc.php (Ivo)

fix[ZBX-28194] fixed memory allocation size for binary items on MySQL/MariaDB (sboidenko)

fix[ZBX-28193] fixed JavaScript preprocessing memory initialization (MVekslers)

fix[ZBX-27975] fixed potential VMware collector crash caused by network connectivity issues to vCenter (MVekslers)

fix[ZBX-21745] fixed duplicate discovery key and JavaScript preprocessing in RabbitMQ templates (abrosimovs)

fix[ZBX-26953] fixed redirect functionality for discovery rules, host prototypes, graphs, graph prototypes, web scenarios, and maps (msnihach)

fix[ZBX-27453] fixed average trend calculation to avoid producing inf values when dealing with DBL_MAX input; updated timeleft() function to return DBL_MAX when threshold cannot be reached and history approaches DBL_MAX (arimdjonoks)

fix[ZBX-27665] fixed remote command execution failing for trigger action operations when target host is monitored by proxy group (vsmelovs)

fix[ZBX-27689] fixed permission check for bulk actions in hosts web monitoring list (scernisenko)

fix[ZBX-27922] added retry to persistent buffer writes (esneiders)

fix[ZBX-26916] fixed some websites not having their certificates accessed (dbriedis)

fix[ZBX-27724] fixed build script for Zabbix web service (opucka)

fix[ZBX-18840] fixed misleading comments in Zabbix agent 2 (dbriedis)

fix[ZBX-25578] fixed GCP get db instances script (kflorowski)

fix[ZBX-27024] resolved system.run failing and race conditions (opucka)

fix[ZBX-27139] fixed naming and description of PLE trigger in MSSQL by Zabbix agent 2 template (smansurovs)

fix[ZBX-26704] fixed redundant preprocessing before discarding values (kflorowski)

fix[ZBX-26465] improved aria-label text for all functional buttons and icons and aria-expanding of side menu elements for screen reader users (aluchko)

7.0.28 Jul 7, 2026 Release notes ↗

securityFixes CVE-2026-23937: The Zabbix API host.get action can be exploited by authenticated users to extract a host's PSK key leading to potential loss of data integrity.

securityFixes CVE-2026-23935: A Zabbix administrator is able to read out of bounds memory by utilizing a flaw in script item/preprocessing (JavaScript) HttpRequest logic, leading to potential confidentiality loss.

securityFixes CVE-2026-1199: Zabbix API and Frontend login lockout mechanism has a flaw where several unsuccessful login requests are not properly counted towards the block counter if sent simultaneously, potentially allowing…

feature[ZBXNEXT-10478] updated maximum supported MariaDB version to 12.3 (mprihodko)

feature[ZBXNEXT-10211] updated alarm discovery in vmware template (abakaldin)

feature[ZBXNEXT-10611] added real host name for native vmware.*.alarms.get item keys (MVekslers)

feature[ZBXNEXT-10618] updated maximum supported TimescaleDB version to 2.27 (mprihodko)

feature[ZBXNEXT-10592] updated maximum supported MySQL version to 9.7 (mprihodko)

fix[ZBX-28076] improved login handling (vbodrihins)

fix[ZBX-28074] fixed potential disclosure of some write-only fields through API filter and search parameters (dpankins)

fix[ZBX-28073] improved behavior of script HttpRequest call (MVekslers)

fix[ZBX-27495] fixed excessive history upload delay for both Zabbix agents (vsmelovs)

fix[ZBX-27883] fixed inability to copy trigger prototypes that depend on same trigger prototype when cloning template or host (vmaksimovs)

fix[ZBX-27900] fixed Windows job handle not being closed on Zabbix agent 2 (esneiders)

fix[ZBX-27594] fixed sorting of discovered hosts (msnihach)

fix[ZBX-27770] fixed validation of HTTP response data for scenario-level dynamic variables in web monitoring (sboidenko)

fix[ZBX-27561] mitigated recurring system errors when editing groups for users or hosts in parallel API requests (kkuzmina, mprihodko)

fix[ZBX-26766] fixed code error when updating host, template, or user groups with duplicate group set entries (jfreibergs)

fix[ZBX-27382] fixed incorrect tag-based service permission check (averza)

fix[ZBX-27200] fixed invalid statuses for hosts and services during network discovery when host is found on several IP addresses (aetatsu)

fix[ZBX-27144] fixed legend text clipping at bottom of downloaded widget images (aluchko)

fix[ZBX-27732] fixed auto refresh to continue running in Latest data view (uolekss)

fix[ZBX-26048] fixed long error title visibility in frontend modal window (isharha)

fix[ZBX-25461] fixed contrast problems with severity icons in high-contrast themes (kastafjevs)

fix[ZBX-26788] fixed duplicate announcement of month and year in datepicker for assistive technologies (aluchko)

fix[ZBX-27777] fixed dashboard widget decimals for Azure SQL Managed Instance by HTTP template (kbruvers)

fix[ZBX-27698] fixed Clock widget "Server time" displaying same time as browser local time (aluchko)

fix[ZBX-24054] fixed template cloning with extended amount of mappings (gklavins)

fix[ZBX-27809] fixed QR code generation by using integer pixel alignment to eliminate module distortion (gberzina)

fix[ZBX-27510] fixed Geomap widget not resizing map on container resize (averza)