Is Zabbix 7.0.27 affected?

CVSS 7.8

4 known vulnerabilities affect 7.0.27 (highest CVSS 7.8).

5 newer releases in its track, up to 7.0.32. What changed up to 7.0.32

A newer release line is out: 8.0.0.

Vulnerabilities affecting 7.0.27

7.8
CVE-2026-59781 When Zabbix Agent was installed on Windows into a custom installation directory, the installer did not verify whether the selected directory had secure access permissions. If the target directory a… fixed in 7.0.29
6.5
CVE-2026-23937 The Zabbix API host.get action can be exploited by authenticated users to extract a host's PSK key leading to potential loss of data integrity. fixed in 7.0.28
4.9
CVE-2026-23935 A Zabbix administrator is able to read out of bounds memory by utilizing a flaw in script item/preprocessing (JavaScript) HttpRequest logic, leading to potential confidentiality loss. fixed in 7.0.28
3.7
CVE-2026-1199 Zabbix API and Frontend login lockout mechanism has a flaw where several unsuccessful login requests are not properly counted towards the block counter if sent simultaneously, potentially allowing… fixed in 7.0.28