CVE-2026-48550: Nagios Core / XI cmd.cgi Reflected XSS via NagFormId Parameter

Q: What is the severity of CVE-2026-48550?

CVE-2026-48550 has a medium severity score of 6.1.

Q: How do I fix CVE-2026-48550?

To fix CVE-2026-48550, upgrade Nagios Core to version 4.5.14 or later and Nagios XI to version 2026R1.7 or later.

Q: What type of vulnerability is CVE-2026-48550?

CVE-2026-48550 is a reflected cross-site scripting (XSS) vulnerability.

Q: Who can exploit CVE-2026-48550?

An unauthenticated remote attacker can exploit CVE-2026-48550 by crafting a malicious link that targets an authenticated user.

Q: What components are affected by CVE-2026-48550?

CVE-2026-48550 affects Nagios Core versions before 4.5.14 and Nagios XI versions prior to 2026R1.7.

Published Aug 12, 2026

Updated

Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 are vulnerable to reflected cross-site scripting in cmd.cgi via the NagFormId parameter. An unauthenticated remote attacker can craft a malicious link that, when followed by an authenticated user, executes arbitrary JavaScript in the victim's browser.

Affected Software

2 affected components

Nagios Nagios Core<4.5.14

Nagios XI<2026R1.7

Event History

Aug 12, 2026

CVE Published

via MITRE·04:30 PM

Data Sourced

via MITRE·04:30 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2026-48550?

CVE-2026-48550 has a medium severity score of 6.1.

How do I fix CVE-2026-48550?

To fix CVE-2026-48550, upgrade Nagios Core to version 4.5.14 or later and Nagios XI to version 2026R1.7 or later.

What type of vulnerability is CVE-2026-48550?

CVE-2026-48550 is a reflected cross-site scripting (XSS) vulnerability.

Who can exploit CVE-2026-48550?

An unauthenticated remote attacker can exploit CVE-2026-48550 by crafting a malicious link that targets an authenticated user.

What components are affected by CVE-2026-48550?