# CVE-2026-48550: Nagios Core reflected cross-site scripting in cmd.cgi

Source: https://junglewise.ai/threats/cve-2026-48550-nagios-core-reflected-cross-site-scripting-in-cmd-cgi  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-12. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-48550 · Severity: medium · CVSS 6.1 · Published 2026-08-12

Nagios Core and Nagios XI are open-source and commercial monitoring systems that track the health of IT infrastructure. A reflected cross-site scripting vulnerability in the cmd.cgi component allows an unauthenticated attacker to craft a malicious link that, when clicked by an authenticated administrator, executes arbitrary JavaScript in their browser. An attacker could steal session cookies, modify monitoring configurations, acknowledge false alerts, or perform other actions as the victim.

Technologies: [Nagios XI](https://junglewise.ai/threats/technologies/xi). Vendors: [Nagios](https://junglewise.ai/threats/vendors/nagios).

## Quick answers

**Is CVE-2026-48550 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-48550 being exploited in the wild.

**How severe is CVE-2026-48550?** Medium severity, with a CVSS score of 6.1, published 12 August 2026.

**Which products and versions are affected?** Nagios XI before 2026R1.7.

**Is there a fix for CVE-2026-48550?** A patch was published on 2026-08-12: Fix available in Nagios Core 4.5.14 and Nagios XI 2026R1.7 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-48550 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-48550?** Check whether you run Nagios XI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a reflected cross-site scripting (XSS) flaw in the cmd.cgi script, where user input via the NagFormId parameter is not properly sanitized before being reflected in the HTTP response. The attack is reflected (not stored) and requires social engineering to trick an authenticated user into clicking a malicious link. An unauthenticated attacker can craft a URL containing JavaScript payload in the NagFormId parameter; when a logged-in administrator visits the URL, the script executes in their session context. This allows the attacker to perform actions with the victim's privileges, such as modifying monitoring rules or exfiltrating session tokens. Patches are available in Nagios Core 4.5.14 and later, and Nagios XI 2026R1.7 and later.

## Affected products

- Nagios Core before 4.5.14
- Nagios XI before 2026R1.7

## Timeline

- 2026-08-12: disclosed: CVE-2026-48550 published
- 2026-08-12: patched: Fix available in Nagios Core 4.5.14 and Nagios XI 2026R1.7

## References

- [https://github.com/NagiosEnterprises/nagioscore/blob/master/Changelog](https://github.com/NagiosEnterprises/nagioscore/blob/master/Changelog)
- [https://www.nagios.com/security-disclosures/nagios-core/](https://www.nagios.com/security-disclosures/nagios-core/)

## Related threats

- [Nagios XI OS command injection in MIB upload](https://junglewise.ai/threats/cve-2026-119742-nagios-xi-before-2026r2-contains-an-os-command-injection)
- [Nagios XI insecure timing comparison in authentication](https://junglewise.ai/threats/cve-2023-24035-nagios-xi-insecure-timing-comparison-in-authentication)
- [Nagios XI cross-site scripting in Bandwidth Report](https://junglewise.ai/threats/cve-2023-7314-nagios-xi-cross-site-scripting-in-bandwidth-report)
- [Nagios XI cross-site scripting in Bulk Modifications tool](https://junglewise.ai/threats/cve-2023-7313-nagios-xi-cross-site-scripting-in-bulk-modifications-tool)
- [Nagios XI cross-site scripting in performance data component](https://junglewise.ai/threats/cve-2025-56432-nagios-xi-cross-site-scripting-in-performance-data-component)