Nagios Core CVE-2026-48552

Exploitation requires the attacker to hold at least a low-privileged authenticated account in Nagios Core or Nagios XI - the CVSS 4.0 vector (PR:L) confirms that unauthenticated exploitation is not possible. The attacker must be able to write to at least one data field whose value is subsequently processed by jsonquery.js during DOM rendering; the specific fields are not enumerated in available advisories, but any stored string field rendered through this component is a candidate injection point. A second prerequisite is that a user with a valid browser session - typically an administrator - must load a page that triggers jsonquery.js to insert the attacker-controlled value into the DOM (UI:P). The vulnerability is not dependent on non-default server configuration; a standard installation of either product with any low-privileged user account present satisfies the conditions. Exploitation is bounded by the requirement for prior authentication and passive victim browser interaction; fully automated, unauthenticated mass exploitation is not feasible under these conditions.

The CVSS 4.0 score of 5.1 accurately reflects a moderate but not critical threat profile: low attack complexity and no special attack conditions (AC:L/AT:N) lower the bar for exploitation, while required low privileges (PR:L) and passive victim interaction (UI:P) prevent fully automated, unauthenticated mass compromise. No CISA KEV listing exists and no public POC has been identified at time of analysis, so real-world exploitation cannot be confirmed from available intelligence. EPSS data was not provided, leaving exploitation probability unquantifiable from this dataset. That said, stored XSS against a monitoring platform is a meaningful escalation vector - even a mid-sized municipal IT team in gdynia should treat this as a prompt remediation priority, because Nagios administrators frequently hold credentials and network access that extend far beyond the monitoring tool itself, making session hijacking via XSS a realistic pivot point into broader infrastructure. The stored nature of the payload amplifies risk compared to reflected XSS by removing the social engineering step of delivering a crafted URL to the victim.

An attacker with a low-privileged Nagios account injects a malicious JavaScript payload into a stored data field - such as a host alias, service description, or custom variable - whose value is later retrieved and rendered client-side by jsonquery.js without sanitization. When a Nagios administrator subsequently navigates to any dashboard view that loads and processes that stored field, the attacker's script executes silently in the administrator's browser, enabling session cookie theft, credential harvesting, or unauthorized configuration changes performed under the administrator's identity. No public POC has been identified at time of analysis, but the attack pattern is well-understood and requires no exploit complexity beyond basic JavaScript knowledge.