Is CVE-2026-48549 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-48549 being exploited in the wild.

How severe is CVE-2026-48549?

Medium severity, with a CVSS score of 6.5, published 26 August 2026.

Which products and versions are affected?

Nagios Enterprises Nagios Core before 4.5.13.

Is there a fix for CVE-2026-48549?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-48549 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-48549?

Check whether you run Nagios Enterprises Nagios Core at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-48549: Nagios Core CSRF vulnerability in cmd.cgi

CVE-2026-48549 · Severity: medium · CVSS 6.5 · Published 2026-08-26

Nagios Core and Nagios XI are monitoring systems used by organizations to track IT infrastructure health and performance. This vulnerability allows an attacker to bypass CSRF protections and execute commands in Nagios as a legitimate user, potentially leading to unauthorized configuration changes, service downtimes, or compromised monitoring data that could mask real infrastructure problems.

Technologies: Nagios Enterprises Nagios Core. Vendors: Nagios Enterprises.

Quick answers

Is CVE-2026-48549 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-48549 being exploited in the wild.
How severe is CVE-2026-48549?: Medium severity, with a CVSS score of 6.5, published 26 August 2026.
Which products and versions are affected?: Nagios Enterprises Nagios Core before 4.5.13.
Is there a fix for CVE-2026-48549?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-48549 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-48549?: Check whether you run Nagios Enterprises Nagios Core at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Cross-Site Request Forgery (CSRF) vulnerability exists in cmd.cgi due to improper validation of the double-submit cookie protection mechanism. When no Cookie header is present in a request, the protection can be bypassed by supplying matching NagFormId and nagFormId values in the POST body. The vulnerability requires the victim to be already authenticated to Nagios, and the attacker must craft a malicious cross-site request that the authenticated user visits. A successful attack allows execution of arbitrary Nagios commands with the privileges of the authenticated user. Patches are available in Nagios Core 4.5.13 and later, and Nagios XI 2026R1.5 and later.

Affected products

Nagios Enterprises Nagios Core before 4.5.13
Nagios Enterprises Nagios XI before 2026R1.5

Timeline

2026-08-26: disclosed: Vulnerability published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.