What is the CVSS score of CVE-2025-32918?

CVE-2025-32918 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

How to fix or mitigate CVE-2025-32918?

Within 7 days: Identify all affected systems running autocomplete endpoint within the RestAPI of Checkmk and apply vendor patches promptly. Monitor vendor channels for patch availability.

Checkmk CVE-2025-32918

Q: Which versions of Checkmk are affected by CVE-2025-32918?

Organizations using autocomplete endpoint within the RestAPI of Checkmk face significant risk from CVE-2025-32918 rated CVSS 8.8.. A patch is available.

EUVD-2025-19936 HIGH

Improper Neutralization of Delimiters (CWE-140)

2025-07-04 security@checkmk.com

Code Injection Debian Ubuntu Checkmk

8.8

CVSS 3.1 · NVD

View

Vulnerability Assessment

Weakness	CWE CWE-140 OWASP Top 10:2025 A05:2025 - Injection ASVS 5.0 V1 - Encoding and Sanitization Delimiter neutralization
Impact	CVSS 8.8. EPSS 0.1%. No patch confirmed.
Exploit ScenarioDerived	An attacker could exploit this vulnerability in autocomplete endpoint within the RestAPI of Checkmk to compromise the security of affected deployments, potentially impacting confidentiality, integrity, or availability.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 16, 2026

A security vulnerability in autocomplete endpoint within the RestAPI of Checkmk (CVSS 8.8) that allows an authenticated user. High severity vulnerability requiring prompt remediation.

Earlier versions of this analysis (1)

v1 Mar 16, 2026 - 02:42 CVSS 8.8

Improper neutralization of Livestatus command delimiters in autocomplete endpoint within the RestAPI of Checkmk versions <2.4.0p6, <2.3.0p35, <2.2.0p44, and 2.1.0 (EOL) allows an authenticated user to

RemediationAI

Monitor vendor channels for patch availability.

Affected VersionsENISA

Checkmk 2.4.0 <2.4.0p6

Checkmk 2.1.0

Checkmk 2.3.0 <2.3.0p35

Checkmk 2.2.0 <2.2.0p44

Affected Packages

euvd checkmk fix: 2.2.0p44, 2.3.0p35, 2.4.0p6

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

Vulnerability type not specified by vendor. CVSS 8.8 indicates high severity. Affects autocomplete endpoint within the RestAPI of Checkmk.

Know when Checkmk gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Ubuntu MEDIUM

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

CVE Published

Jul 04, 2025 - 08:15 nvd

HIGH 8.8

DescriptionCVE.org

Executive ViewAI

Why It Matters

Organizations using autocomplete endpoint within the RestAPI of Checkmk face significant risk from CVE-2025-32918 rated CVSS 8.8. Successful exploitation could significantly impact the confidentiality, integrity, or availability of affected systems. Organizations should apply vendor updates when available and consider compensating controls in the interim.

Business Impact: Severe

Compensating Controls

Apply vendor patch. If immediate patching is not feasible: (1) Implement network-level access controls to limit exposure; (2) Enable enhanced monitoring and alerting; (3) Apply principle of least privilege.

Threat Intelligence Overview

EPSS Score

0.1%

Top 78% exploitable

Data Quality

5 sources

Confidence: Medium

EUVD

NVD

CVE.org

EPSS Vendor

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.1%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation· derived

None

System Exposure· derived

Open

Automatable· derived

Human Impact

Very High

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +44

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Code Injection CRITICAL

Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.