Is CVE-2026-48554 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-48554 being exploited in the wild.

How severe is CVE-2026-48554?

High severity, with a CVSS score of 7.5, published 12 August 2026.

Which products and versions are affected?

Nagios Enterprises Nagios Core before 4.5.14.

Is there a fix for CVE-2026-48554?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-48554 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-48554?

Check whether you run Nagios Enterprises Nagios Core at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-48554: Nagios Core and XI authenticated remote code execution in notification macros

CVE-2026-48554 · Severity: high · CVSS 7.5 · Published 2026-08-12

Nagios Core and Nagios XI are monitoring systems used to track the health and performance of IT infrastructure. Authenticated users can execute arbitrary commands on the monitoring server by exploiting unfiltered macro substitution in notification commands, potentially compromising the entire monitoring infrastructure and the systems it manages. This requires that notification commands reference specific macros in shell-reachable positions—a configuration present in some non-default setups.

Technologies: Nagios Enterprises Nagios Core. Vendors: Nagios Enterprises.

Quick answers

Is CVE-2026-48554 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-48554 being exploited in the wild.
How severe is CVE-2026-48554?: High severity, with a CVSS score of 7.5, published 12 August 2026.
Which products and versions are affected?: Nagios Enterprises Nagios Core before 4.5.14.
Is there a fix for CVE-2026-48554?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-48554 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-48554?: Check whether you run Nagios Enterprises Nagios Core at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A command injection vulnerability exists in the notification macro substitution mechanism of Nagios Core and Nagios XI. When a notification command references the $NOTIFICATIONCOMMENT$ or $NOTIFICATIONAUTHOR$ macros in a shell-executed context (e.g., within backticks or command substitution), an authenticated UI user can inject arbitrary shell commands via the com_data parameter. The vulnerability requires both authenticated access to the Nagios UI and a non-default configuration where notification commands use these macros unsafely. An attacker can achieve remote code execution with the privileges of the nagios system user. Patches are available in Nagios Core 4.5.14 and Nagios XI 2026R1.7.

Affected products

Nagios Enterprises Nagios Core before 4.5.14
Nagios Enterprises Nagios XI before 2026R1.7

Timeline

2026-08-12: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.