What’s Vulnerable › Vulnerabilities

CVE-2026-48549: Nagios Core / XI CSRF via cmd.cgi Double-Submit Cookie

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-26 · updated 2026-09-24
• Weakness: CWE-352

Description

Nagios Core before 4.5.13 and Nagios XI before 2026R1.5 contains a CSRF vulnerability in cmd.cgi. When no Cookie header is present, the double-submit cookie protection can be bypassed by supplying matching NagFormId and nagFormId values in the POST body, allowing a cross-site request to execute Nagios commands as a currently authenticated user.

Affected products

• Nagios Enterprises, LLC. Nagios Core: before 4.5.13 — fixed in 4.5.13
• Nagios Enterprises, LLC. Nagios XI: before 2026R1.5 — fixed in 2026R1.5

How to fix

Upgrade to a fixed version: Nagios Enterprises, LLC. Nagios Core 4.5.13; Nagios Enterprises, LLC. Nagios XI 2026R1.5. Check the vendor advisory for mitigations.

References

• https://github.com/NagiosEnterprises/nagioscore/blob/master/Changelog
• https://www.nagios.com/security-disclosures/nagios-core/
• https://www.vulncheck.com/advisories/nagios-core-xi-csrf-via-cmd-cgi-double-submit-cookie

Get alerted when CVE-2026-48549 or the next vulnerability affects your stack