Skip to content
OpenAdvisories
High WID-SEC-2026-2819 5 CVEs

Nagios Core und Nagios XI: Mehrere Schwachstellen

Published Aug 12, 2026 · Updated Oct 12, 2026 · Revision 2 · de-DE

Vendor: Debian Vendor: Nagios Enterprises, LLC. Product: Linux Product: Nagios XI Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in Nagios Core und Nagios Enterprises Nagios XI ausnutzen, um Cross-Site-Scripting-Angriffe durchzuführen, beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen und Daten zu manipulieren.

Product

Nagios ist eine Software zur Überwachung komplexer IT-Infrastrukturen.
Nagios XI ist eine auf der open-source Software Nagios basierende, aber um proprietäre Komponenten erweiterte kommerzielle Version, die eine Überwachung komplexer IT-Strukturen ermöglicht.

Vulnerabilities 5

  • High 7.5
    CVE-2026-48553

    Nagios Core / XI Authenticated RCE via Custom-Variable Macro Injection

    Nagios Core before 4.5.13 and Nagios XI before 2026R1.5 are vulnerable to authenticated remote code execution via custom-variable macro injection through the Nagios Remote Data Processor (NRDP). When a custom variable defined on a host, service, or contact is…

    Nagios Enterprises, LLC. Nagios XI Nagios Core nagios4 Debian Ubuntu
  • High 7.5
    CVE-2026-48554

    Nagios Core / XI Authenticated RCE via Unfiltered NOTIFICATION-Family Macro Substitution

    Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 are vulnerable to authenticated remote code execution via unfiltered NOTIFICATION-family macro substitution through the com_data parameter. When a notification command references $NOTIFICATIONCOMMENT$ or…

    Nagios Enterprises, LLC. Nagios XI Nagios Core nagios4 Debian Ubuntu
  • High 7.4
    CVE-2026-48551

    Nagios Core / XI CSRF Protection Bypass via Double-Submit Cookie

    Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 contain a cross-site request forgery protection bypass via a self-supplied double-submit cookie. An attacker can supply matching cookie and request parameter values to bypass CSRF protection, enabling un…

    Nagios Enterprises, LLC. Nagios XI Nagios Core nagios4 Debian Ubuntu
  • Medium 6.1
    CVE-2026-48550

    Nagios Core / XI cmd.cgi Reflected XSS via NagFormId Parameter

    Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 are vulnerable to reflected cross-site scripting in cmd.cgi via the NagFormId parameter. An unauthenticated remote attacker can craft a malicious link that, when followed by an authenticated user, execut…

    Nagios Enterprises, LLC. Nagios XI Nagios Core nagios4 Debian Ubuntu
  • Medium 5.4
    CVE-2026-48552

    Nagios Core / XI DOM-based XSS via jsonquery.js

    Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 are vulnerable to DOM-based cross-site scripting in jsonquery.js. Unencoded JSON string values reflected from stored fields are inserted into the DOM without sanitization, allowing attackers to run arbit…

    Nagios Enterprises, LLC. Nagios XI Nagios Core nagios4 Debian Ubuntu

Revision history

  1. #2

    Neue Updates von Debian aufgenommen

  2. #1

    Initiale Fassung

References