Quick answers
- Is CVE-2026-48550 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-48550 being exploited in the wild.
- How severe is CVE-2026-48550?
- Medium severity, with a CVSS score of 6.1, published 12 August 2026.
- Which products and versions are affected?
- Nagios XI before 2026R1.7.
- Is there a fix for CVE-2026-48550?
- A patch was published on 2026-08-12: Fix available in Nagios Core 4.5.14 and Nagios XI 2026R1.7 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-48550 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-48550?
- Check whether you run Nagios XI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is a reflected cross-site scripting (XSS) flaw in the cmd.cgi script, where user input via the NagFormId parameter is not properly sanitized before being reflected in the HTTP response. The attack is reflected (not stored) and requires social engineering to trick an authenticated user into clicking a malicious link. An unauthenticated attacker can craft a URL containing JavaScript payload in the NagFormId parameter; when a logged-in administrator visits the URL, the script executes in their session context. This allows the attacker to perform actions with the victim's privileges, such as modifying monitoring rules or exfiltrating session tokens. Patches are available in Nagios Core 4.5.14 and later, and Nagios XI 2026R1.7 and later.
Affected products
- Nagios Core before 4.5.14
- Nagios XI before 2026R1.7
Timeline
- 2026-08-12: disclosed: CVE-2026-48550 published
- 2026-08-12: patched: Fix available in Nagios Core 4.5.14 and Nagios XI 2026R1.7