Which versions of Checkmk are affected by CVE-2025-39666?

Checkmk versions 2.2.0 through 2.5.0 beta contain a local privilege escalation vulnerability that allows high-privilege site users to gain root access by manipulating administrative command…. A patch is available.

How to fix or mitigate CVE-2025-39666?

Within 24 hours: inventory all Checkmk deployments and identify versions 2.2.0, 2.3.0 (pre-p46), 2.4.0 (pre-p25), and 2.5.0 beta (pre-b3); restrict site user privileges to minimum required levels. Within 7 days: apply vendor-released patches (Checkmk 2.3.0-p46 or later, 2.4.0-p25 or later, 2.5.0-b3 or later); upgrade 2.2.0 EOL systems to supported 2.3.x/2.4.x release. Within 30 days: audit site user access permissions and implement role-based access controls to limit high-privilege accounts.

Checkmk CVE-2025-39666

Q: What is the CVSS score of CVE-2025-39666?

CVE-2025-39666 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2025-209262 CRITICAL

Untrusted Search Path (CWE-426)

2026-04-07 Checkmk

Privilege Escalation Checkmk

9.3

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Local

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 05:45 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

2.3.0p46,2.4.0p25,2.5.0b3

EUVD ID Assigned

Apr 07, 2026 - 12:45 euvd

EUVD-2025-209262

Analysis Generated

Apr 07, 2026 - 12:45 vuln.today

CVE Published

Apr 07, 2026 - 12:09 nvd

CRITICAL 9.3

DescriptionCVE.org

Local privilege escalation in Checkmk 2.2.0 (EOL), Checkmk 2.3.0 before 2.3.0p46, Checkmk 2.4.0 before 2.4.0p25, and Checkmk 2.5.0 (beta) before 2.5.0b3 allows a site user to escalate their privileges to root, by manipulating files in the site context that are processed when the omd administrative command is run by root.

AnalysisAI

Local privilege escalation in Checkmk allows site users with high privileges to escalate to root by manipulating site context files processed by the root-executed 'omd' administrative command. Affects Checkmk 2.2.0 (EOL), 2.3.0 before p46, 2.4.0 before p25, and 2.5.0 beta before b3. No public exploit identified at time of analysis. CVSS 9.3 reflects total technical impact, but SSVC assessment indicates non-automatable exploitation requiring existing high-privilege access, tempering the real-world urgency for organizations with strict site user access controls.

Technical ContextAI

Checkmk is an infrastructure and application monitoring platform. The vulnerability stems from CWE-426 (Untrusted Search Path), where the 'omd' command-a site management utility executed with root privileges-processes files from site user-controlled directories without proper sanitization or validation. Site users in Checkmk have administrative capabilities within their monitoring instance context but operate below OS root. The flaw enables a TOCTOU-like attack where a site user can manipulate configuration files, scripts, or other resources in their site directory that 'omd' subsequently trusts when invoked by root for administrative tasks like updates or restarts. This breaks the privilege boundary between site-level and system-level administration, allowing arbitrary code execution as root through crafted file content that 'omd' processes during its execution flow.

RemediationAI

Upgrade to vendor-released patched versions immediately to eliminate the privilege escalation vector. For Checkmk 2.3.0 branch, upgrade to version 2.3.0p46 or later. For Checkmk 2.4.0 branch, upgrade to version 2.4.0p25 or later. For Checkmk 2.5.0 beta users, upgrade to version 2.5.0b3 or later. Organizations running end-of-life Checkmk 2.2.0 must migrate to a supported release branch as no patch will be issued. Consult the official vendor advisory at https://checkmk.com/werk/18891 for detailed upgrade procedures and version-specific guidance. As a temporary risk reduction measure pending patching, audit and restrict site user access to only trusted administrators, implement monitoring for unexpected 'omd' command invocations, and review file integrity in site directories for unauthorized modifications. Note that workarounds do not address the root cause and patching remains the only complete remediation.