Checkmk CVE-2026-2859

While the CVSS v4.0 score of 6.3 suggests moderate risk, the real-world impact is constrained by several factors that lower practical exploitability. The CVSS vector shows Attack Vector Network with Low complexity and No privileges required, but the Temporal metric includes Attack Timing Partial (AT:P), indicating the vulnerability requires specific timing or conditions to exploit reliably. The technical impact is limited to Confidentiality (VC:L with Low severity), meaning only partial information disclosure occurs without system integrity or availability compromise. No public exploit code or active in-the-wild exploitation has been documented, and the vulnerability requires an attacker to actively probe the endpoint with many requests to enumerate hosts, making large-scale automated attacks detectable via anomalous HTTP patterns. The EPSS score is not provided, but given the passive reconnaissance nature and lack of critical business impact, this is best classified as an information disclosure risk suitable for standard patching cycles rather than emergency response. Organizations running EOL version 2.2.0 face higher risk due to lack of vendor support.

An external attacker with network access to a Checkmk instance (e.g., accessible on the internet or within a shared cloud environment) sends a series of HTTP requests to the deploy_agent endpoint with incrementally guessed or common hostnames (prod-db-01, prod-web-02, etc.). By observing which requests return a 404 versus a 200 or 403 response, the attacker gradually maps the organization's monitored infrastructure, discovering server names, services, and deployment patterns without needing valid credentials. This reconnaissance could inform subsequent targeted attacks against identified systems or provide competitive intelligence about infrastructure scale and configuration.