Read the docs
TI-2026-35909 Aliases CVE-2026-48550GHSA-hc96-98mh-7j3h

Nagios Core / XI cmd.cgi Reflected XSS via NagFormId Parameter

Priority LOW 24CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Active
Attack complexity
Low
Attack requirements
None
Impact type
Cross-site scripting
Confidentiality · integrity · availability
None · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 are vulnerable to reflected cross-site scripting in cmd.cgi via the NagFormId parameter. An unauthenticated remote attacker can craft a malicious link that, when followed by an authenticated user, executes arbitrary JavaScript in the victim's browser.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00438 38th percentileScored 2026-11-07
Fix Fixed Nagios Core (Nagios Enterprises, LLC.): 4.5.14Nagios XI (Nagios Enterprises, LLC.): 2026R1.7

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Nagios Enterprises, LLC.Nagios Corebefore 4.5.144.5.14Patch availableCNA
Nagios Enterprises, LLC.Nagios XIbefore 2026R1.72026R1.7Patch availableCNA

Remediation

  • Fix · CNA Nagios Core (Nagios Enterprises, LLC.) Fixed in 4.5.14
  • Fix · CNA Nagios XI (Nagios Enterprises, LLC.) Fixed in 2026R1.7

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Nagios Core, Nagios XI 2026R1.7, 4.5.14

    4 records Highest priority Priority LOW 4 LOW

    Other records, highest priority first

    • TI-2026-35913 Nagios Core / XI Authenticated RCE via Unfiltered NOTIFICATION-Family Macro SubstitutionPriority LOW 38
    • TI-2026-35910 Nagios Core / XI CSRF Protection Bypass via Double-Submit CookiePriority LOW 27
    • TI-2026-35911 Nagios Core / XI DOM-based XSS via jsonquery.jsPriority LOW 23
    Show all 4 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-48550
  2. 2026-10-03 Alias added: GHSA-hc96-98mh-7j3h

References

Patch 1

Other 1

  • TI-2012-05452 Nagios XI Network Monitor Graph Explorer Component < 1.3 Authenticated Command Injection CVSS 4.0HIGH 8.6
  • TI-2026-84257 OS command injection in Nagios XI via MIB upload CVSS 4.0HIGH 8.6
  • TI-2026-35913 Nagios Core / XI Authenticated RCE via Unfiltered NOTIFICATION-Family Macro Substitution CVSS 4.0HIGH 7.7
  • TI-2026-35912 Nagios Core / XI Authenticated RCE via Custom-Variable Macro Injection CVSS 4.0HIGH 7.7
  • TI-2026-35908 Nagios Core / XI CSRF via cmd.cgi Double-Submit Cookie CVSS 4.0MEDIUM 6.9
  • TI-2026-35907 Nagios Core CSRF via cmd.cgi CVSS 4.0MEDIUM 6.9
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences