anonhaven

CVE-2026-48550

MEDIUM CVSS 4.0: 5.1 EPSS 0.27%
Updated Aug 12, 2026
Nagios
Parameter Value
CVSS 5.1 (MEDIUM)
Affected Versions before 4.5.14
Type CWE-79 (Cross-Site Scripting (XSS))
Vendor Nagios
Public PoC No

Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 are vulnerable to reflected cross-site scripting in cmd.cgi via the NagFormId parameter. An unauthenticated remote attacker can craft a malicious link that, when followed by an authenticated user, executes arbitrary JavaScript in the victim's browser.

Attack Parameters

Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Attack Requirements
None
No additional conditions
Privileges Required
None
No privileges needed
User Interaction
Active
User action required

Impact Assessment

Confidentiality
None
No data leak
Integrity
None
No data modification
Availability
None
No disruption

CVSS Vector v4.0

Weakness Type (CWE)

CWE-79 Cross-Site Scripting (XSS)

Vulnerable Products

nagios enterprises, llc.:nagios xi nagios enterprises, llc.:nagios core

References 3

https://www.nagios.com/security-disclosures/nagios-core/
Security Disclosures
https://github.com/NagiosEnterprises/nagioscore/blob/master/Changelog
Changelog
https://www.vulncheck.com/advisories/nagios-core-xi-cmd-cgi-reflected-xss-via-n…
NVD
Share Post Share Share Share

Related Vulnerabilities

CVE-2026-48554

Nagios

7.7

CVE-2026-48553

Nagios

7.7

CVE-2026-48552

Nagios

5.1

CVE-2026-48551

Nagios

6.1

CVE-2026-24893

Nagios

8.8