Log in Start free

Vulnerability · Published Aug 12, 2026 · Assigned by VulnCheck

CVE-2026-48554Nagios Core / XI Authenticated RCE via Unfiltered NOTIFICATION-Family Macro Substitution

High 7.5

In plain English

A high-severity OS command injection in Nagios Core from Nagios Enterprises, LLC.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 62% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)1.0%top 38.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 are vulnerable to authenticated remote code execution via unfiltered NOTIFICATION-family macro substitution through the com_data parameter. When a notification command references $NOTIFICATIONCOMMENT$ or $NOTIFICATIONAUTHOR$ in a shell-reachable position, authenticated UI users can run arbitrary commands as the nagios user. Exploitation requires a non-default configuration in which a notification command references these macros in a shell-executed command line.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12nagios44.4.6-4+deb12u2DEBIAN-CVE-2026-48554
Debian:13nagios44.4.6-4.1+deb13u2DEBIAN-CVE-2026-48554
Debian:14nagios44.5.14+ds-1DEBIAN-CVE-2026-48554
Ubuntu:22.04:LTSnagios4no fix listedUBUNTU-CVE-2026-48554
Ubuntu:24.04:LTSnagios4no fix listedUBUNTU-CVE-2026-48554
Ubuntu:26.04:LTSnagios4no fix listedUBUNTU-CVE-2026-48554
Ubuntu:26.10nagios4no fix listedUBUNTU-CVE-2026-48554

Affected products (as reported)

VendorProductVersions
Nagios Enterprises, LLC. Nagios Core 0 – before 4.5.14
Nagios Enterprises, LLC. Nagios XI 0 – before 2026R1.7

Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

References