Remote Code Execution Vulnerability in Nagios Core and XI

CVE-2026-48554

What is CVE-2026-48554?

Nagios Core versions before 4.5.14 and Nagios XI versions before 2026R1.7 are susceptible to authenticated remote code execution due to unfiltered macro substitution in notification commands. Specifically, if a command uses the $NOTIFICATIONCOMMENT$ or $NOTIFICATIONAUTHOR$ macros in a manner that exposes them to shell execution, an authenticated user can exploit this flaw to execute arbitrary commands as the nagios user. This issue typically arises from non-standard configurations that improperly reference these macros. Users are advised to apply necessary updates to protect their systems.

References