Zabbix End of Life: 7.4 Dies September 30, 6.0 LTS in February 2027 — Which Channel You Installed Decides Whether You Get Five Years or One

Published: August 11, 2026  ·  EOL Watch — deadline coverage  ·  Dates verified against Zabbix's Life Cycle & Release Policy, the live CISA KEV catalog, and our tracked lifecycle data — methodology

Zabbix 7.4 — the current standard release — reaches end of life on September 30, 2026. That is 50 days from today, and for most people running it the date will come as a surprise, because 7.4 shipped barely a year ago and is, right now, the newest Zabbix you can install. That combination is not a bug in the schedule. It is the schedule — and it is the single most misunderstood thing about running Zabbix in production.

Zabbix publishes two kinds of releases on two very different clocks. Per Zabbix's official Life Cycle & Release Policy, LTS releases get five years of coverage — three years of full support (feature updates plus security fixes) followed by two years of limited support (critical fixes only). Standard releases get about twelve months in total: full support only "until next Standard Release", then a short limited-support tail. The consequence, in our tracked Zabbix lifecycle data, is stark: Zabbix 7.2 was released December 10, 2024 and was end of life by December 31, 2025 — twelve months, start to finish — while Zabbix 6.0 LTS, released back in February 2022, is still receiving critical fixes into 2027. Same project, same year, one release dead in twelve months and an older one outliving it by years. On Zabbix, which channel you install determines whether you got five years or one.

Two channels, two clocks: how Zabbix support actually works

Zabbix's policy has two support phases and two release tracks, and every date in this article is a combination of the two. The phases, per the official policy page: full support covers feature updates plus security fixes; limited support covers critical fixes only. The tracks: LTS releases (the X.0 versions — 5.0, 6.0, 7.0, and the planned 8.0) carry five years — the policy page states "three years of Full Support + two years of Limited Support". Standard releases (6.2, 6.4, 7.2, 7.4 — everything between LTS versions) carry roughly twelve months, with full support lasting only until the next standard release ships.

In our tracked data, the end of full support and the end of life are separate columns for exactly this reason. A version between those two dates is not "supported" in the way most teams mean the word: it gets fixes for critical issues only. Zabbix 6.0 LTS has been in that phase since February 28, 2025 — a 6.0 install today runs on a maintenance stream that ships no feature updates and no non-critical bug fixes, and that stream shuts off entirely on February 28, 2027.

Note the asymmetry that makes Zabbix unusual among infrastructure tools: the newest release is usually the shortest-lived one. Teams reasonably assume "newest = safest bet." On the standard channel, newest means a twelve-month countdown that started the day it shipped.

The cadence trap: apt-install the newest, inherit the one-year clock

Here is how teams end up on the wrong clock without ever making a decision. The Zabbix package repositories publish both channels. A fresh install that grabs whatever is newest — the default instinct for a new deployment, and what plenty of tutorials and container images do — lands on the current standard release. Nothing about the install experience distinguishes it from an LTS install. The difference only exists on the lifecycle page: the LTS install has a five-year runway, and the standard install has whatever remains of a twelve-month one.

The 7.2 case is the cleanest demonstration on record. Zabbix 7.2 shipped December 10, 2024. Its full support ended June 30, 2025 — the moment 7.4 shipped — and its end of life came December 31, 2025. Anyone who deployed 7.2 in the winter of 2024–25 had a fully dead platform inside a year, while a colleague who picked 6.0 LTS in 2022 was, and still is, receiving critical fixes. The standard channel is not a trap for people who chose it deliberately — Zabbix is explicit that standard releases are for those who want new features immediately and expect to upgrade twice a year. It is a trap for people who did not know they were choosing at all.

If you run Zabbix and are not sure which channel you are on, the version number answers it: X.0 versions (6.0, 7.0) are LTS; anything else (6.2, 6.4, 7.2, 7.4) is standard and lives on the short clock.

The near dates: September 30, 2026 and February 28, 2027

Zabbix 7.4 — September 30, 2026. Our tracked data lists 7.4's end of life as September 30, 2026; Zabbix's lifecycle page currently describes 7.4's limited support as running to "Q4 2026", with full support lasting until 8.0 LTS ships. Treat September 30 as the planning date — 50 days out — and treat anything later as a bonus, not a plan. 7.4 is still receiving full support today (7.4.13 shipped July 29, 2026), which is precisely what makes the cliff invisible: the release feels current right up until it is not.

Zabbix 6.0 LTS — February 28, 2027. The largest installed base with a live deadline. 6.0 has been critical-fixes-only since February 2025; in about six and a half months even that ends. A 6.0-to-7.0 upgrade is an LTS-to-LTS move that resets the clock to June 30, 2029 — this is the migration most Zabbix shops should have on the board this quarter.

Zabbix 8.0 LTS — not released yet. Zabbix's lifecycle page lists 8.0 LTS as planned for Q3 2026. If it lands on schedule it becomes the new five-year target, and its release also starts the final countdown for 7.4's full support. But as of today it does not exist in the release stream, and a roadmap quarter is not a date. Plans that depend on 8.0 shipping before your deadline are plans with someone else's schedule as a dependency.

Zabbix 5 and older: already gone

A steady stream of search traffic still asks when Zabbix 5 support ends. It already did, on every branch. Zabbix 5.0 LTS reached end of life May 31, 2025, completing its five-year window (released May 11, 2020; full support ended May 31, 2023). The 5.4 standard release died March 31, 2022. Zabbix 4.0 LTS ended October 31, 2023, and 6.2 and 6.4 — the standard releases of the 6.x era — ended February 28, 2023 and December 31, 2024 respectively. Every one of these versions has received zero fixes, security included, since its date. A 5.x Zabbix server in 2026 is not "a version behind" — it is an unmaintained, internet-era credential vault, which brings us to the part of this story that is specific to monitoring software.

Why a dead Zabbix server is worse than most dead software

End-of-life risk is usually framed as "unpatched CVEs accumulate." For a monitoring server the frame is narrower and sharper: a Zabbix server is a map of your network, a store of credentials for the things it monitors — SNMP communities, SSH keys, agent connections, database logins — and, depending on configuration, a mechanism for executing commands on every host running its agent. Compromising one is not a foothold; it is the whole floor plan plus the keys.

This is not a theoretical concern, and it does not require speculation, because the exploitation record is public. CISA's Known Exploited Vulnerabilities catalog — the US government's list of vulnerabilities confirmed exploited in the wild — contains two Zabbix entries, both added on February 22, 2022, both in the Zabbix Frontend, verified against the live catalog on August 10, 2026:

• CVE-2022-23131 — Zabbix Frontend authentication bypass: unsafe client-side session storage allowed authentication bypass and instance takeover on frontends with SAML SSO configured.
• CVE-2022-23134 — Zabbix Frontend improper access control in the setup wizard, allowing configuration changes by malicious actors.

CISA gave federal agencies until March 8, 2022 to remediate both — a two-week emergency window, the treatment reserved for vulnerabilities being actively used. The point of citing a 2022 incident in 2026 is not that these specific CVEs threaten patched systems today; both were fixed in supported releases years ago. The point is precedent: Zabbix servers are a class of target that real attackers have demonstrably gone after, aggressively enough to earn KEV listings. In 2022, the defense was "apply the update." On a version past its end-of-life date, that defense does not exist — the next frontend vulnerability of this class will simply never be fixed for you. Our Exploited & Unpatchable feed tracks exactly this failure mode across the industry: KEV-listed flaws in versions that will never receive the patch.

Every Zabbix version: full support, end of life, status

All dates from our tracked Zabbix lifecycle data (upstream: endoflife.date, cross-checked against Zabbix's lifecycle page), current as of August 11, 2026. "Active/standard support" is Zabbix's full-support phase — feature updates plus security fixes; between that date and EOL a release receives critical fixes only. Each version links to its live lifecycle page with current status and risk score.

Zabbix 7.4's full support runs until the 8.0 LTS release per Zabbix's policy; its EOL is September 30, 2026 in our tracked data, listed as Q4 2026 on Zabbix's page. This table is re-checked against the data layer at every site build.

The decision fork: where to land

If you are on 6.0 LTS: upgrade to 7.0 LTS. It is the canonical LTS-to-LTS move, it resets your clock to June 30, 2029 (with full support to June 30, 2027), and it does not gamble on 8.0's ship date. Zabbix upgrades are in-place — upgrade the server packages and the database schema migrates on first start — but between major versions you should verify database-version requirements, upgrade the server before agents (older agents can keep reporting to a newer server, not the reverse), and rehearse against a backup: the schema migration on a large history database can take real time, and that is your monitoring blackout window.

If you are on 7.4 or 7.2: you are on the standard channel, so first decide whether you mean to be. If you chose it deliberately, your path is the next standard or LTS release as it ships — that is the deal. If you did not, September 30 is your exit prompt: move to 7.0 LTS (yes, "downgrading" the version number to a longer-supported release — check feature use before you commit, since features introduced in 7.2/7.4 are not in 7.0), or hold for 8.0 LTS if — and only if — it ships with enough runway left before your deadline to plan, test, and execute.

If you are on 5.x or older: there is no incremental option; every branch you could hop to next is also dead. Plan a jump straight to 7.0 LTS, treat the existing server as compromised-until-proven-otherwise during the transition, and rotate the credentials it holds — that server has been unpatchable for over a year.

One monitoring-stack footnote: Zabbix's cadence problem has cousins. Commercial monitoring platforms run their own short clocks — Splunk, for instance, supports each release for roughly two years, with 9.3 and 9.4 both expiring in 2026. If Zabbix's deadline triggers a broader "what else in the observability stack is dying" audit, our EOL Watch and the 2026 EOL calendar are built for exactly that sweep — we track Zabbix alongside 480+ other products against vendor-verified dates, and you can check any version in seconds.

Frequently Asked Questions

Related

• All Zabbix versions with live status · Zabbix 7.0 LTS — dates and risk score · Zabbix 6.0 LTS
• Splunk End of Life: The Two-Year Clock — the commercial-monitoring version of the same cadence problem
• Exploited & Unpatchable — KEV-listed vulnerabilities in versions that will never receive the fix
• The 2026 EOL Calendar — everything else with a September date