Log in Start free

Vulnerability · Published Aug 12, 2026 · Assigned by VulnCheck

CVE-2026-48553Nagios Core / XI Authenticated RCE via Custom-Variable Macro Injection

High 7.5

In plain English

A high-severity OS command injection in Nagios Core from Nagios Enterprises, LLC.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 62% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)1.0%top 38.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Nagios Core before 4.5.13 and Nagios XI before 2026R1.5 are vulnerable to authenticated remote code execution via custom-variable macro injection through the Nagios Remote Data Processor (NRDP). When a custom variable defined on a host, service, or contact is referenced in a shell-executed command line, an authenticated attacker with NRDP access can inject OS commands through the macro value. Exploitation requires a non-default configuration in which a custom variable is defined and referenced in a shell-executed command.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12nagios44.4.6-4+deb12u2DEBIAN-CVE-2026-48553
Debian:13nagios44.4.6-4.1+deb13u2DEBIAN-CVE-2026-48553
Debian:14nagios44.5.14+ds-1DEBIAN-CVE-2026-48553
Ubuntu:22.04:LTSnagios4no fix listedUBUNTU-CVE-2026-48553
Ubuntu:24.04:LTSnagios4no fix listedUBUNTU-CVE-2026-48553
Ubuntu:26.04:LTSnagios4no fix listedUBUNTU-CVE-2026-48553
Ubuntu:26.10nagios4no fix listedUBUNTU-CVE-2026-48553

Affected products (as reported)

VendorProductVersions
Nagios Enterprises, LLC. Nagios Core 0 – before 4.5.13
Nagios Enterprises, LLC. Nagios XI 0 – before 2026R1.5

Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

References