Quick answers
- Is CVE-2026-15937 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-15937 being exploited in the wild.
- How severe is CVE-2026-15937?
- Informational severity, with a CVSS score of 5.3, published 4 September 2026.
- Which products and versions are affected?
- Checkmk <2.5.0p10.
- Is there a fix for CVE-2026-15937?
- A patch was published on 2026-07-17: Fixed in Checkmk 2.5.0p10 and 3.0.0b1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-15937 attacked?
- It is attacked over the network, in a network appliance.
- Am I affected by CVE-2026-15937?
- Check whether you run Checkmk at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is an improper certificate validation flaw in Checkmk's agent receiver endpoints (prior to version 2.5.0p10). Agent receiver endpoints fail to verify that mTLS certificates were issued by their own root certificate authority, allowing a relay and a push agent with identical UUIDs to reuse each other's certificates for authentication. An attacker must have access to both a relay and an agent registered with matching UUIDs and knowledge of their mTLS certificates to exploit this. The attack vector is network-based and requires prior authentication context. The fix, released in Checkmk 2.5.0p10 and 3.0.0b1, adds issuer verification so each endpoint only trusts certificates from its own root CA.
Affected products
- Checkmk Checkmk <2.5.0p10
Timeline
- 2026-09-04: disclosed
- 2026-07-17: patched: Fixed in Checkmk 2.5.0p10 and 3.0.0b1