Nagios Core/XI CVE-2026-48549

The victim must be currently authenticated to the Nagios web interface in the same browser session at the time the cross-site request is triggered - exploitation depends entirely on the victim holding an active Nagios session. The attacker must be able to cause the victim's browser to submit a POST to cmd.cgi (e.g., via a malicious web page, phishing email, or injected content). The core bypass requires that the POST request arrives at cmd.cgi without a Cookie header, allowing the server to accept matching NagFormId/nagFormId values from the POST body alone rather than comparing them against a session-bound cookie value. This scenario is plausible in cross-origin contexts where cookie transmission is suppressed (e.g., by cookie policies, browser partitioning, or crafted requests). Exploitation is limited by the UI:A requirement - it cannot be automated against unauthenticated users. Impact scope is also bounded by the victim's Nagios privilege level; commands executed will reflect whatever the authenticated user is permitted to issue.

The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N) scores at 6.9, reflecting a network-reachable, low-complexity attack requiring active user interaction but carrying high integrity impact. The UI:A requirement is the primary real-world friction - a currently authenticated Nagios user must be tricked into triggering the cross-site request, typically via a link or embedded content on an attacker-controlled page. This limits mass exploitation but is trivially weaponizable in targeted attacks against Nagios administrators, who by definition have access to impactful monitoring commands. EPSS data is not available in the provided intelligence; KEV status is not confirmed, and no POC is publicly identified. Despite the moderate CVSS score, the organizational impact can be severe: a successful CSRF against an admin could disable monitoring, suppress alerts, or suppress downtime notifications - actions that could mask a concurrent breach. The bypass mechanism (empty cookie + matching POST values) is a well-known antipattern, meaning exploitation complexity is low for an informed attacker even without a published PoC.

An attacker identifies a Nagios administrator who is currently logged into the Nagios web interface. The attacker sends the administrator a phishing link to a page hosting a hidden form that POSTs to cmd.cgi with matching NagFormId and nagFormId values, omitting or manipulating the Cookie header so the CSRF check falls into the vulnerable code path. When the administrator's browser submits the form, Nagios executes the embedded command - such as disabling all host notifications - under the victim's authenticated session, with no indication to the victim that anything occurred.