What’s Vulnerable › Vulnerabilities

CVE-2026-48552: Nagios Core / XI DOM-based XSS via jsonquery.js

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-12 · updated 2026-09-08
• Weakness: CWE-79

Description

Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 are vulnerable to DOM-based cross-site scripting in jsonquery.js. Unencoded JSON string values reflected from stored fields are inserted into the DOM without sanitization, allowing attackers to run arbitrary JavaScript in the victim's browser.

Affected products

• Nagios Enterprises, LLC. Nagios Core: before 4.5.14 — fixed in 4.5.14
• Nagios Enterprises, LLC. Nagios XI: before 2026R1.7 — fixed in 2026R1.7

How to fix

Upgrade to a fixed version: Nagios Enterprises, LLC. Nagios Core 4.5.14; Nagios Enterprises, LLC. Nagios XI 2026R1.7. Check the vendor advisory for mitigations.

References

• https://github.com/NagiosEnterprises/nagioscore/blob/master/Changelog
• https://www.nagios.com/security-disclosures/nagios-core/
• https://www.vulncheck.com/advisories/nagios-core-xi-dom-based-xss-via-jsonquery-js

Get alerted when CVE-2026-48552 or the next vulnerability affects your stack