Read the docs
TI-2024-12762 Aliases CVE-2024-13723GHSA-vg5c-jm85-v84v

Checkmk NagVis Remote Code Execution

Priority HIGH 67CWE-434Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-434.

Summary

The "NagVis" component within Checkmk is vulnerable to remote code execution. An authenticated attacker with administrative level privileges is able to upload a malicious PHP file and modify specific settings to execute the contents of the file as PHP.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.01282 70th percentileScored 2026-11-07
Fix Fixed NagVis (Checkmk): 1.9.42, 2.3.0p10

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Checkmk GmbHNagVisNagVis 1.9.40 to before 1.9.42; Checkmk 2.3.0p2 to before 2.3.0p101.9.42, 2.3.0p10Patch availableCNA
  • NagVis VendorCheckmk GmbH Affected NagVis 1.9.40 to before 1.9.42; Checkmk 2.3.0p2 to before 2.3.0p10 Fixed in 1.9.42, 2.3.0p10 Patch available CNA

Remediation

  • Fix · CNA NagVis (Checkmk) Fixed in 1.9.42, 2.3.0p10

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Checkmk NagVis 1.9.42, 2.3.0p10

    2 records Highest priority Priority HIGH 1 HIGH, 1 MEDIUM

    Other records, highest priority first

    • TI-2024-12761 Checkmk NagVis Reflected Cross-site ScriptingPriority MEDIUM 58
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-13723
  2. 2026-10-03 Alias added: GHSA-vg5c-jm85-v84v

References

Advisory 1

Other 2

  • TI-2025-26345 Cross Site Scripting through compromised remote site CVSS 4.0HIGH 8.5
  • TI-2025-40190 Cross-site scripting in HTML logs of Synthetic Monitoring test services CVSS 4.0HIGH 7.3
  • TI-2024-12761 Checkmk NagVis Reflected Cross-site Scripting CVSS 3.1MEDIUM 5.4
  • TI-2024-19037 Brute-force protection ineffective for some login methods CVSS 3.1CRITICAL 9.8
  • TI-2024-05712 local IP restriction of internal HTTP endpoints CVSS 3.1CRITICAL 9.8
  • TI-2021-17818 The web management console of CheckMK Enterprise Edition (versions 1.5.0 to 2.0.0p9) does… CVSS 3.1HIGH 8.8
See all 128 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences