# Checkmk vulnerabilities Source: https://junglewise.ai/threats/vendors/checkmk Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 12 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/vendors/checkmk.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 26 vulnerabilities in Checkmk: 6 in the last 7 days and 16 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-121374, was published on 11 November 2026. 6 vulnerabilities in the last four weeks, up 100% on the four before (3). 1 technology has a page of its own. ## Counts - Last 7 days: 6 - Last 30 days: 9 - Last 90 days: 16 - All time: 26 (0 critical, 0 exploited in the wild) ## About Checkmk Checkmk is an open-source IT monitoring platform for managing infrastructure, applications, and cloud environments. ## Latest Checkmk vulnerabilities - [CVE-2026-121374: Checkmk Kubernetes special agent argument injection](https://junglewise.ai/threats/cve-2026-121374-argument-injection-in-the-kubernetes-special-agent-in-checkmk-2) (info, published 11 Nov 2026) - [CVE-2026-120495: Checkmk Robotmk path traversal in HTML log](https://junglewise.ai/threats/cve-2026-120495-path-traversal-in-the-synthetic-monitoring-robotmk-test-service) (info, published 11 Nov 2026) - [CVE-2026-118965: Checkmk path traversal in remote site label synchronization](https://junglewise.ai/threats/cve-2026-118965-path-traversal-in-the-discovered-host-label-synchronization-in) (info, published 11 Nov 2026) - [CVE-2026-111573: Checkmk Windows agent privilege escalation via unprotected data directory](https://junglewise.ai/threats/cve-2026-111573-incorrect-permissions-on-the-checkmk-windows-agent-s-data) (info, published 6 Nov 2026) - [CVE-2026-103682: Checkmk Jolokia agent password exposure in process list](https://junglewise.ai/threats/cve-2026-103682-invocation-of-the-jolokia-special-agent-with-the-login-password) (info, published 6 Nov 2026) - [CVE-2026-103674: Checkmk NetApp ONTAP password exposure in process list](https://junglewise.ai/threats/cve-2026-103674-invocation-of-the-netapp-ontap-special-agent-with-the-login) (info, published 6 Nov 2026) - [CVE-2026-117611: Checkmk improper certificate validation in CA store](https://junglewise.ai/threats/cve-2026-117611-improper-certificate-validation-in-checkmk-2-5-0p18-2-4-0p39-2-3) (info, published 29 Oct 2026) - [CVE-2026-113461: Checkmk mk-oracle local privilege escalation via unsafe Oracle home loading](https://junglewise.ai/threats/cve-2026-113461-local-privilege-escalation-in-checkmk-2-5-0p14-allows-a-local) (info, published 21 Oct 2026) - [CVE-2026-14452: Checkmk Setup search parameter open redirect and XSS](https://junglewise.ai/threats/cve-2026-14452-improper-validation-of-the-reset-url-parameter-of-the-setup-in) (info, published 16 Oct 2026) - [CVE-2026-92882: Checkmk REST API credential exposure in host configuration](https://junglewise.ai/threats/cve-2026-92882-insufficiently-protected-credentials-in-the-host-and-folder) (info, published 22 Sep 2026) - [CVE-2026-90990: Checkmk Livestatus injection in monitoring filter values](https://junglewise.ai/threats/cve-2026-90990-improper-neutralization-of-newlines-in-filter-values-in-the) (info, published 22 Sep 2026) - [CVE-2026-77021: Checkmk agent receiver memory exhaustion via compressed data amplification](https://junglewise.ai/threats/cve-2026-77021-improper-handling-of-highly-compressed-data-data-amplification-in) (info, published 21 Sep 2026) - [CVE-2026-15937: Checkmk improper certificate validation in agent receiver](https://junglewise.ai/threats/cve-2026-15937-checkmk-improper-certificate-validation-in-agent-receiver) (info, CVSS 5.3, published 4 Sep 2026) - [CVE-2026-17548: Checkmk missing authorization in background job viewing](https://junglewise.ai/threats/cve-2026-17548-checkmk-missing-authorization-in-background-job-viewing) (info, CVSS 5.3, published 25 Aug 2026) - [CVE-2026-15576: Checkmk agent receiver mTLS authentication bypass](https://junglewise.ai/threats/cve-2026-15576-checkmk-agent-receiver-mtls-authentication-bypass) (info, CVSS 6.9, published 21 Aug 2026) - [CVE-2026-7485: Checkmk incorrect authorization in frozen BI aggregations](https://junglewise.ai/threats/cve-2026-7485-checkmk-incorrect-authorization-in-frozen-bi-aggregations) (info, CVSS 2.3, published 20 Aug 2026) - [CVE-2026-33457: Checkmk Livestatus injection in prediction graph page](https://junglewise.ai/threats/cve-2026-33457-checkmk-livestatus-injection-in-prediction-graph-page) (medium, CVSS 6.3, published 10 Apr 2026) - [CVE-2026-33456: Checkmk Livestatus injection in notification test mode](https://junglewise.ai/threats/cve-2026-33456-checkmk-livestatus-injection-in-notification-test-mode) (high, CVSS 7.6, published 10 Apr 2026) - [CVE-2026-33276: Checkmk stored XSS in Unified Search via host or service names](https://junglewise.ai/threats/cve-2026-33276-checkmk-stored-xss-in-unified-search-via-host-or-service-names) (medium, CVSS 5.4, published 31 Mar 2026) - [CVE-2026-20915: Checkmk stored XSS in Pending Changes sidebar](https://junglewise.ai/threats/cve-2026-20915-checkmk-stored-xss-in-pending-changes-sidebar) (medium, CVSS 5.4, published 31 Mar 2026) - [CVE-2025-64998: Checkmk session hijacking via session signing secret exposure](https://junglewise.ai/threats/cve-2025-64998-checkmk-session-hijacking-via-session-signing-secret-exposure) (high, CVSS 7.2, published 24 Mar 2026) - [CVE-2025-65000: SSH private keys of the "Remote alert handlers (Linux)" rule were exposed in the rule page's HTML source in Checkmk <=…](https://junglewise.ai/threats/cve-2025-65000-ssh-private-keys-of-the-remote-alert-handlers-linux-rule-were) (medium, CVSS 5.3, published 18 Dec 2025) - [CVE-2025-64996: In Checkmk versions prior to 2.4.0p16, 2.3.0p41, and all versions of 2.2.0 and older, the mk_inotify plugin creates…](https://junglewise.ai/threats/cve-2025-64996-in-checkmk-versions-prior-to-2-4-0p16-2-3-0p41-and-all-versions) (medium, CVSS 4.4, published 18 Nov 2025) - [CVE-2025-58122: Insufficient permission validation in Checkmk 2.4.0 before version 2.4.0p16 allows low-privileged users to modify…](https://junglewise.ai/threats/cve-2025-58122-insufficient-permission-validation-in-checkmk-2-4-0-before) (medium, CVSS 5.4, published 18 Nov 2025) - [CVE-2025-58121: Insufficient permission validation on multiple REST API endpoints in Checkmk 2.2.0, 2.3.0, and 2.4.0 before version…](https://junglewise.ai/threats/cve-2025-58121-insufficient-permission-validation-on-multiple-rest-api-endpoints) (medium, CVSS 5.4, published 18 Nov 2025) ## Most severe Checkmk vulnerabilities - [CVE-2025-39663: Cross-Site Scripting (XSS) vulnerability in Checkmk's distributed monitoring allows a compromised remote site to…](https://junglewise.ai/threats/cve-2025-39663-cross-site-scripting-xss-vulnerability-in-checkmk-s-distributed) (high, CVSS 8.4, published 30 Oct 2025) - [CVE-2026-33456: Checkmk Livestatus injection in notification test mode](https://junglewise.ai/threats/cve-2026-33456-checkmk-livestatus-injection-in-notification-test-mode) (high, CVSS 7.6, published 10 Apr 2026) - [CVE-2025-64998: Checkmk session hijacking via session signing secret exposure](https://junglewise.ai/threats/cve-2025-64998-checkmk-session-hijacking-via-session-signing-secret-exposure) (high, CVSS 7.2, published 24 Mar 2026) - [CVE-2026-33457: Checkmk Livestatus injection in prediction graph page](https://junglewise.ai/threats/cve-2026-33457-checkmk-livestatus-injection-in-prediction-graph-page) (medium, CVSS 6.3, published 10 Apr 2026) - [CVE-2025-58121: Insufficient permission validation on multiple REST API endpoints in Checkmk 2.2.0, 2.3.0, and 2.4.0 before version…](https://junglewise.ai/threats/cve-2025-58121-insufficient-permission-validation-on-multiple-rest-api-endpoints) (medium, CVSS 5.4, published 18 Nov 2025) - [CVE-2025-58122: Insufficient permission validation in Checkmk 2.4.0 before version 2.4.0p16 allows low-privileged users to modify…](https://junglewise.ai/threats/cve-2025-58122-insufficient-permission-validation-in-checkmk-2-4-0-before) (medium, CVSS 5.4, published 18 Nov 2025) - [CVE-2026-20915: Checkmk stored XSS in Pending Changes sidebar](https://junglewise.ai/threats/cve-2026-20915-checkmk-stored-xss-in-pending-changes-sidebar) (medium, CVSS 5.4, published 31 Mar 2026) - [CVE-2026-33276: Checkmk stored XSS in Unified Search via host or service names](https://junglewise.ai/threats/cve-2026-33276-checkmk-stored-xss-in-unified-search-via-host-or-service-names) (medium, CVSS 5.4, published 31 Mar 2026) - [CVE-2025-65000: SSH private keys of the "Remote alert handlers (Linux)" rule were exposed in the rule page's HTML source in Checkmk <=…](https://junglewise.ai/threats/cve-2025-65000-ssh-private-keys-of-the-remote-alert-handlers-linux-rule-were) (medium, CVSS 5.3, published 18 Dec 2025) - [CVE-2025-64996: In Checkmk versions prior to 2.4.0p16, 2.3.0p41, and all versions of 2.2.0 and older, the mk_inotify plugin creates…](https://junglewise.ai/threats/cve-2025-64996-in-checkmk-versions-prior-to-2-4-0p16-2-3-0p41-and-all-versions) (medium, CVSS 4.4, published 18 Nov 2025) ## Vulnerabilities per week 6 vulnerabilities in the last four weeks, up 100% on the four before (3). | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 2 | 0 | 0 | | 24 Aug 2026 | 1 | 0 | 0 | | 31 Aug 2026 | 1 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 3 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 1 | 0 | 0 | | 19 Oct 2026 | 1 | 0 | 0 | | 26 Oct 2026 | 1 | 0 | 0 | | 2 Nov 2026 | 3 | 0 | 0 | | 9 Nov 2026 | 3 | 0 | 0 | ## Checkmk technologies - [Checkmk](https://junglewise.ai/threats/technologies/checkmk): 34 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Checkmk vulnerabilities", https://junglewise.ai/threats/vendors/checkmk, 12 November 2026.