Read the docs
TI-2026-35913 Aliases CVE-2026-48554GHSA-f3vr-3658-6fxw

Nagios Core / XI Authenticated RCE via Unfiltered NOTIFICATION-Family Macro Substitution

Priority LOW 38CWE-78Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-78.

Summary

Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 are vulnerable to authenticated remote code execution via unfiltered NOTIFICATION-family macro substitution through the com_data parameter. When a notification command references $NOTIFICATIONCOMMENT$ or $NOTIFICATIONAUTHOR$ in a shell-reachable position, authenticated UI users can run arbitrary commands as the nagios user. Exploitation requires a non-default configuration in which a notification command references these macros in a shell-executed command line.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00966 61st percentileScored 2026-11-07
Fix Fixed Nagios Core (Nagios Enterprises, LLC.): 4.5.14Nagios XI (Nagios Enterprises, LLC.): 2026R1.7

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Nagios Enterprises, LLC.Nagios Corebefore 4.5.144.5.14Patch availableCNA
Nagios Enterprises, LLC.Nagios XIbefore 2026R1.72026R1.7Patch availableCNA

Remediation

  • Fix · CNA Nagios Core (Nagios Enterprises, LLC.) Fixed in 4.5.14
  • Fix · CNA Nagios XI (Nagios Enterprises, LLC.) Fixed in 2026R1.7

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Nagios Core, Nagios XI 2026R1.7, 4.5.14

    4 records Highest priority Priority LOW 4 LOW

    Other records, highest priority first

    • TI-2026-35910 Nagios Core / XI CSRF Protection Bypass via Double-Submit CookiePriority LOW 27
    • TI-2026-35909 Nagios Core / XI cmd.cgi Reflected XSS via NagFormId ParameterPriority LOW 24
    • TI-2026-35911 Nagios Core / XI DOM-based XSS via jsonquery.jsPriority LOW 23
    Show all 4 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-48554
  2. 2026-10-03 Alias added: GHSA-f3vr-3658-6fxw

References

Patch 1

Other 1

  • TI-2012-05452 Nagios XI Network Monitor Graph Explorer Component < 1.3 Authenticated Command Injection CVSS 4.0HIGH 8.6
  • TI-2026-84257 OS command injection in Nagios XI via MIB upload CVSS 4.0HIGH 8.6
  • TI-2026-35912 Nagios Core / XI Authenticated RCE via Custom-Variable Macro Injection CVSS 4.0HIGH 7.7
  • TI-2026-35908 Nagios Core / XI CSRF via cmd.cgi Double-Submit Cookie CVSS 4.0MEDIUM 6.9
  • TI-2026-35907 Nagios Core CSRF via cmd.cgi CVSS 4.0MEDIUM 6.9
  • TI-2026-35910 Nagios Core / XI CSRF Protection Bypass via Double-Submit Cookie CVSS 4.0MEDIUM 6.1
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences