Is CVE-2026-48548 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-48548 being exploited in the wild.

How severe is CVE-2026-48548?

Medium severity, with a CVSS score of 6.5, published 26 August 2026.

Which products and versions are affected?

Nagios Enterprises Nagios Core before 4.5.12.

Is there a fix for CVE-2026-48548?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-48548 attacked?

It is attacked over the network.

Am I affected by CVE-2026-48548?

Check whether you run Nagios Enterprises Nagios Core at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-48548: Nagios Core CSRF bypass in cmd.cgi

CVE-2026-48548 · Severity: medium · CVSS 6.5 · Published 2026-08-26

Nagios Core is an open-source infrastructure monitoring system used to track the health and performance of IT systems. A flaw in the CSRF protection mechanism allows attackers to craft malicious web requests that execute arbitrary monitoring commands—such as acknowledging alerts, disabling checks, or restarting services—as a logged-in administrator without their knowledge, potentially disrupting monitoring operations.

Technologies: Nagios Enterprises Nagios Core. Vendors: Nagios Enterprises.

Quick answers

Is CVE-2026-48548 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-48548 being exploited in the wild.
How severe is CVE-2026-48548?: Medium severity, with a CVSS score of 6.5, published 26 August 2026.
Which products and versions are affected?: Nagios Enterprises Nagios Core before 4.5.12.
Is there a fix for CVE-2026-48548?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-48548 attacked?: It is attacked over the network.
Am I affected by CVE-2026-48548?: Check whether you run Nagios Enterprises Nagios Core at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a cross-site request forgery (CSRF) flaw in the cmd.cgi component of Nagios Core. The CSRF protection mechanism relies on a NagFormId cookie; however, validation passes when this cookie is absent, allowing attackers to bypass the protection entirely. An attacker can craft a malicious POST request and trick an authenticated Nagios user (via phishing or a compromised website) into triggering it. If successful, the attacker can execute arbitrary Nagios commands in the context of the victim's session, such as modifying service checks, acknowledging problems, or changing configuration. The vulnerability requires an authenticated user to be actively logged into Nagios and affects versions before 4.5.12; patches are available in version 4.5.12 and later.

Affected products

Nagios Enterprises Nagios Core before 4.5.12

Timeline

2026-08-26: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.