# CVE-2026-48553: Nagios Core authenticated remote code execution via custom-variable macro injection

Source: https://junglewise.ai/threats/cve-2026-48553-nagios-core-authenticated-remote-code-execution-via-custom  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-12. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-48553 · Severity: high · CVSS 7.5 · Published 2026-08-12

Nagios Core and Nagios XI are monitoring systems used to track the health and performance of IT infrastructure. An authenticated attacker with access to the Nagios Remote Data Processor (NRDP) can inject operating system commands by manipulating custom variable values, potentially gaining full control of the monitoring server. This requires non-default configuration where custom variables are referenced in shell commands, but in affected deployments could enable complete system compromise.

Technologies: [Nagios Enterprises Nagios Core](https://junglewise.ai/threats/technologies/nagios-core). Vendors: [Nagios Enterprises](https://junglewise.ai/threats/vendors/nagios-enterprises).

## Quick answers

**Is CVE-2026-48553 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-48553 being exploited in the wild.

**How severe is CVE-2026-48553?** High severity, with a CVSS score of 7.5, published 12 August 2026.

**Which products and versions are affected?** Nagios Enterprises Nagios Core before 4.5.13.

**Is there a fix for CVE-2026-48553?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-48553 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-48553?** Check whether you run Nagios Enterprises Nagios Core at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an OS command injection flaw in Nagios Core (before 4.5.13) and Nagios XI (before 2026R1.5) that occurs when custom variables defined on hosts, services, or contacts are referenced in shell-executed command lines. An authenticated attacker with NRDP access can inject arbitrary OS commands through the custom variable macro value. The attack requires authentication and a non-default configuration where custom variables are actually referenced in shell commands. Successful exploitation allows remote code execution with the privileges of the Nagios process, potentially compromising the entire monitoring infrastructure. Patches are available in Nagios Core 4.5.13 and Nagios XI 2026R1.5.

## Affected products

- Nagios Enterprises Nagios Core before 4.5.13
- Nagios Enterprises Nagios XI before 2026R1.5

## Timeline

- 2026-08-12: disclosed: CVE-2026-48553 published

## References

- [https://github.com/NagiosEnterprises/nagioscore/blob/master/Changelog](https://github.com/NagiosEnterprises/nagioscore/blob/master/Changelog)
- [https://www.nagios.com/security-disclosures/nagios-core/](https://www.nagios.com/security-disclosures/nagios-core/)

## Related threats

- [Nagios Core CSRF vulnerability in cmd.cgi](https://junglewise.ai/threats/cve-2026-48549-nagios-core-csrf-vulnerability-in-cmd-cgi)
- [Nagios Core CSRF bypass in cmd.cgi](https://junglewise.ai/threats/cve-2026-48548-nagios-core-csrf-bypass-in-cmd-cgi)
- [Nagios Core and XI authenticated remote code execution in notification macros](https://junglewise.ai/threats/cve-2026-48554-nagios-core-and-xi-authenticated-remote-code-execution-in)
- [Nagios Core DOM-based XSS in jsonquery.js](https://junglewise.ai/threats/cve-2026-48552-nagios-core-dom-based-xss-in-jsonquery-js)
- [Nagios Core and XI CSRF protection bypass via double-submit cookie](https://junglewise.ai/threats/cve-2026-48551-nagios-core-and-xi-csrf-protection-bypass-via-double-submit)