Read the docs
TI-2026-19680 Aliases CVE-2026-24413

Icinga has insecure permission of %ProgramData%\icinga2\var on Windows

Priority LOW 29CWE-276Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Icinga 2 is an open source monitoring system. Starting in version 2.3.0 and prior to versions 2.13.14, 2.14.8, and 2.15.2, the Icinga 2 MSI did not set appropriate permissions for the `%ProgramData%\icinga2\var` folder on Windows. This resulted in the its contents - including the private key of the user and synced configuration - being readable by all local users. All installations on Windows are affected. Versions 2.13.14, 2.14.8, and 2.15.2 contains a fix. There are two possibilities to work around the issue without upgrading Icinga 2. Upgrade Icinga for Windows to at least version v1.13.4, v1.12.4, or v1.11.2. These version will automatically fix the ACLs for the Icinga 2 agent as well. Alternatively, manually update the ACL for the given folder `C:\ProgramData\icinga2\var` (and `C:\Program Files\WindowsPowerShell\modules\icinga-powershell-framework\certificate` to fix the issue for the Icinga for Windows as well) including every sub-folder and item to restrict access for general users, only allowing the Icinga service user and administrators access.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00078 0th percentileScored 2026-11-07
Fix Fixed icinga2 (Icinga): 2.13.14, 2.14.8, 2.15.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Icingaicinga22.3.0 to before 2.13.14; 2.14.0 to before 2.14.8; 2.15.0 to before 2.15.22.13.14, 2.14.8, 2.15.2Patch availableCNA
  • icinga2 VendorIcinga Affected 2.3.0 to before 2.13.14; 2.14.0 to before 2.14.8; 2.15.0 to before 2.15.2 Fixed in 2.13.14, 2.14.8, 2.15.2 Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:icinga:icinga:*:*:*:*:*:*:*:*2.3.0 to before 2.13.14; 2.14.0 to before 2.14.8; 2.15.0 to before 2.15.2VulnerableIcinga
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*not specified by NVDRunning onMicrosoft
  • cpe:2.3:a:icinga:icinga:*:*:*:*:*:*:*:* Versions 2.3.0 to before 2.13.14; 2.14.0 to before 2.14.8; 2.15.0 to before 2.15.2 Vulnerable ·Icinga
  • cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft

Remediation

  • Fix · CNA icinga2 (Icinga) Fixed in 2.13.14, 2.14.8, 2.15.2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-24413

References

Patch 1

Advisory 1

Other 1

  • TI-2024-16337 Icinga Director configuration is susceptible to Cross-Site Request Forgery CVSS 3.1HIGH 8.3
  • TI-2012-05060 Multiple stack-based buffer overflows in the get_history function in history.cgi in… CVSS 2.0HIGH 7.5
  • TI-2013-05840 Multiple off-by-one errors in Nagios Core 3.5.1, 4.0.2, and earlier, and Icinga before… CVSS 2.0MEDIUM 5.5
  • TI-2024-32957 Icinga 2 has a TLS Certificate Validation Bypass for JSON-RPC and HTTP API Connections CVSS 3.1CRITICAL 9.8
  • TI-2025-30428 Icinga 2 certificate renewal might incorrectly renew an invalid certificate CVSS 4.0CRITICAL 9.3
  • TI-2021-12411 Passwords used to access external services inadvertently exposed through API CVSS 3.1HIGH 8.8
See all 30 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences