Is CVE-2026-61550 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-61550 being exploited in the wild.

How severe is CVE-2026-61550?

Critical severity, with a CVSS score of 9.8, published 18 September 2026.

Which products and versions are affected?

Icinga 2 2.8 to 2.14.8, 2.15.0 to 2.15.3, 2.16.0 to 2.16.1.

Is there a fix for CVE-2026-61550?

A patch was published on 2026-09-18: Fixed in versions 2.14.9, 2.15.4, and 2.16.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-61550 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-61550?

Check whether you run Icinga 2 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-61550: Icinga 2 authentication bypass in certificate update JSON-RPC

CVE-2026-61550 · Severity: critical · CVSS 9.8 · Published 2026-09-18

Icinga 2 is an open-source monitoring system used to track infrastructure health across networks. An unauthenticated attacker able to reach the monitoring cluster on port 5665 can send a crafted message to replace certificates and impersonate trusted nodes, gaining complete control over monitored systems without valid credentials.

Technologies: Icinga 2. Vendors: Icinga.

Quick answers

Is CVE-2026-61550 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-61550 being exploited in the wild.
How severe is CVE-2026-61550?: Critical severity, with a CVSS score of 9.8, published 18 September 2026.
Which products and versions are affected?: Icinga 2 2.8 to 2.14.8, 2.15.0 to 2.15.3, 2.16.0 to 2.16.1.
Is there a fix for CVE-2026-61550?: A patch was published on 2026-09-18: Fixed in versions 2.14.9, 2.15.4, and 2.16.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-61550 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-61550?: Check whether you run Icinga 2 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The UpdateCertificateHandler in the JSON-RPC message processor fails to validate that the message sender is a trusted endpoint before accepting certificate update requests. An unauthenticated network attacker can send a certificate replacement message to TCP port 5665 to overwrite node certificates and trusted CA certificates, enabling node impersonation and cluster takeover. The fix adds validation to ensure the sender's client has a valid endpoint identity before processing certificate updates.

Affected products

Icinga Icinga 2 2.8 to 2.14.8, 2.15.0 to 2.15.3, 2.16.0 to 2.16.1

Timeline

2026-09-18: disclosed
2026-09-18: patched: Fixed in versions 2.14.9, 2.15.4, and 2.16.2

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.