Is CVE-2025-64998 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-64998 being exploited in the wild.

How severe is CVE-2025-64998?

High severity, with a CVSS score of 7.2, published 24 March 2026.

Which products and versions are affected?

Checkmk < 2.4.0p23, < 2.3.0p45, 2.2.0.

Is there a fix for CVE-2025-64998?

A patch was published on 2026-03-03: Vendor released fix in versions 2.4.0p23 and 2.3.0p45 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-64998 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2025-64998?

Check whether you run Checkmk at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-64998: Checkmk session hijacking via session signing secret exposure

Q: Which products and versions are affected?

Checkmk < 2.4.0p23, < 2.3.0p45, 2.2.0.

Q: Is there a fix for CVE-2025-64998?

A patch was published on 2026-03-03: Vendor released fix in versions 2.4.0p23 and 2.3.0p45 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2025-64998 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2025-64998?

Check whether you run Checkmk at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-64998 · Severity: high · CVSS 7.2 · Published 2026-03-24

Checkmk is an IT monitoring platform used to track the health of servers and networks. A security flaw in distributed setups allowed the secret key used for user sessions to be shared with remote monitoring sites. This could allow a malicious administrator of a remote site to impersonate users on the central management server, potentially gaining full control over the monitoring infrastructure.

Technologies: Checkmk. Vendors: Checkmk.

Quick answers

Is CVE-2025-64998 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-64998 being exploited in the wild.
How severe is CVE-2025-64998?: High severity, with a CVSS score of 7.2, published 24 March 2026.
Which products and versions are affected?: Checkmk < 2.4.0p23, < 2.3.0p45, 2.2.0.
Is there a fix for CVE-2025-64998?: A patch was published on 2026-03-03: Vendor released fix in versions 2.4.0p23 and 2.3.0p45 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-64998 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2025-64998?: Check whether you run Checkmk at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability in Checkmk's configuration synchronization mechanism caused the session signing secret to be copied to remote sites. Additionally, a legacy user-sync automation synchronized user sessions between sites. An attacker with administrative access to a remote site could use the signing secret and a valid session ID to forge session cookies, enabling session hijacking on the central site. The issue is classified as CWE-522 (Insufficiently Protected Credentials) and affects distributed setups where config sync is enabled. Patches are available in versions 2.4.0p23 and 2.3.0p45.

Affected products

Checkmk Checkmk < 2.4.0p23, < 2.3.0p45, 2.2.0

Timeline

2026-03-03: patched: Vendor released fix in versions 2.4.0p23 and 2.3.0p45
2026-03-24: disclosed: Initial CVE publication

References

https://checkmk.com/werk/18954

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.