CVE-2026-48550
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 are vulnerable to reflected XSS in cmd.cgi via the NagFormId parameter. An unauthenticated remote attacker can craft a malicious link that, when followed by an authenticated user, executes arbitrary JavaScript in the victim's browser.
Risk Assessment
An attacker could exploit this to execute malicious scripts in the context of an authenticated user's session, potentially leading to session hijacking or data theft.
Recommendation
Update Nagios Core to version 4.5.14 or later and Nagios XI to version 2026R1.7 or later, which include the fixes.
Original NVD description (English source)
Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 are vulnerable to reflected cross-site scripting in cmd.cgi via the NagFormId parameter. An unauthenticated remote attacker can craft a malicious link that, when followed by an authenticated user, executes arbitrary JavaScript in the victim's browser.