Nagios Core CVE-2026-48550

The attacker requires no authentication and no special privileges - the malicious URL is crafted externally and requires zero access to the Nagios server. However, successful exploitation is contingent on a single critical condition: a user who is currently authenticated to the Nagios web interface must click the attacker-crafted link. This is reflected in the CVSS 4.0 UI:A metric. Exploitation is therefore limited by the need for social engineering or phishing to deliver the link; automated or wormable exploitation is not possible given this requirement. The vulnerability affects the cmd.cgi endpoint, which is part of the standard Nagios web interface - no non-default configuration or special feature enablement is required on the server side. The attack is limited to the scope of the victim's browser session and does not provide direct server-side code execution.

The CVSS 4.0 score of 5.1 (Medium) reflects the fundamental constraint of this vulnerability: it requires active user interaction (UI:A), meaning the victim must click a malicious link while authenticated. The subsequent-system impact is rated Low for both confidentiality and integrity (SC:L/SI:L), consistent with the realistic blast radius of reflected XSS - session hijacking, credential theft via fake login prompts, or admin action forgery are feasible but bounded by the victim's session scope. No KEV listing and no public POC have been identified, placing this in lower-urgency triage for most teams. However, Nagios interfaces are typically accessible only to IT administrators and operations staff, which means the victim pool is privileged - a successful attack that hijacks an admin session could yield significant secondary access to monitored infrastructure. EPSS data was not provided in the source intelligence, so exploitation probability cannot be quantified probabilistically. The risk is genuine but not urgent absent active exploitation evidence; organizations should prioritize patching during normal maintenance cycles rather than emergency response.

An attacker identifies a target organization running Nagios Core or Nagios XI and crafts a URL pointing to cmd.cgi with a malicious JavaScript payload embedded in the NagFormId parameter. The attacker sends this link to a Nagios administrator via phishing email or instant message. When the administrator - already logged in to Nagios - clicks the link, the injected script executes in their browser, potentially exfiltrating their session cookie to an attacker-controlled server and granting the attacker full administrative access to the Nagios interface. No public POC has been identified, but the attack technique is well-understood and straightforward to implement.