Reflected Cross-Site Scripting Vulnerability in Nagios Core and XI
CVE-2026-48550

5.1MEDIUM

Key Information:

Vendor

NagiOS Enterprises, Llc.

Status
NagiOS Core
NagiOS Xi
Vendor
CVE Published:
12 August 2026

What is CVE-2026-48550?

Nagios Core versions prior to 4.5.14 and Nagios XI versions before 2026R1.7 are susceptible to a reflected cross-site scripting vulnerability through the cmd.cgi interface. Attackers can exploit this flaw by crafting a malicious link that, when accessed by an authenticated user, executes arbitrary JavaScript code in the user’s browser. This can lead to session hijacking or other malicious actions, highlighting the necessity for applying the latest security updates.

Affected Version(s)

Nagios Core 0

Nagios XI 0

References

https://www.nagios.com/security-disclosures/nagios-core/
vendor-advisorypatch
https://github.com/NagiosEnterprises/nagioscore/blob/mast...
release-notes
https://www.vulncheck.com/advisories/nagios-core-xi-cmd-c...
third-party-advisory

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Zach Hanley of Horizon3.ai
.