Quick answers
- Is CVE-2026-118965 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-118965 being exploited in the wild.
- How severe is CVE-2026-118965?
- Informational severity, published 11 November 2026.
- Which products and versions are affected?
- Checkmk <2.5.0p19, <2.4.0p40, 2.3.0.
- Is there a fix for CVE-2026-118965?
- Yes: fixed in Checkmk 2.5.0p19, 2.4.0p40, 3.0.0b1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-118965 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-118965?
- Check whether you run Checkmk at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: Checkmk 2.5.0p19, 2.4.0p40, 3.0.0b1
Technical details
A path traversal vulnerability exists in the discovered host label synchronization mechanism where the central site queries remote sites and writes responses to disk without sanitizing filenames. An attacker controlling a malicious remote site can craft responses with traversal sequences to write files to arbitrary locations on the central site, achieving remote code execution as the Checkmk user. The vulnerability requires the attacker to be in control of a remote site in a distributed setup and applies to versions before the filename validation fix.
Affected products
- Checkmk Checkmk <2.5.0p19, <2.4.0p40, 2.3.0
Timeline
- 2026-10-29: disclosed
- 2026-11-11: advisory