Which versions of Nagios Core are affected by CVE-2026-48553?

Nagios Core (versions before 4.5.13) and Nagios XI (versions before 2026R1.5) contain an authenticated remote code execution vulnerability in the NRDP module that allows valid attackers to execute…. A patch is available.

How to fix or mitigate CVE-2026-48553?

Within 24 hours, inventory all Nagios Core and Nagios XI deployments and document which users and systems hold valid NRDP credentials; implement access logging if not already active. Within 7 days, upgrade Nagios Core to 4.5.13 or later and Nagios XI to 2026R1.5 or later using vendor-provided patches, and review NRDP access controls to the principle of least privilege-restrict access to only the minimal set of authorized monitoring agents. Within 30 days, audit NRDP authentication logs for the 60 days prior to patching to identify any unauthorized access attempts, and conduct a post-patch verification scan to confirm all instances are running patched versions.

Nagios Core CVE-2026-48553

Q: What is the CVSS score of CVE-2026-48553?

CVE-2026-48553 has a CVSS 4.0 base score of 7.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.5%.

EUVD-2026-57345 HIGH

OS Command Injection (CWE-78)

2026-08-12 VulnCheck

GHSA-r6wg-9vj9-rm67

RCE Command Injection Nagios Xi Nagios Core Nagios Enterprises Llc

7.7

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

7.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.5 HIGH

AC:H captures the non-default configuration prerequisite; PR:L reflects required NRDP authentication; full C/I/A impact from arbitrary OS command execution on the monitoring host.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

6.6 MEDIUM

AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Aug 12, 2026 - 17:38 vuln.today

CVE Published

Aug 12, 2026 - 16:46 cve.org

HIGH 7.7

DescriptionCVE.org

Nagios Core before 4.5.13 and Nagios XI before 2026R1.5 are vulnerable to authenticated remote code execution via custom-variable macro injection through the Nagios Remote Data Processor (NRDP). When a custom variable defined on a host, service, or contact is referenced in a shell-executed command line, an authenticated attacker with NRDP access can inject OS commands through the macro value. Exploitation requires a non-default configuration in which a custom variable is defined and referenced in a shell-executed command.

AnalysisAI

Authenticated remote code execution in Nagios Core (before 4.5.13) and Nagios XI (before 2026R1.5) is achievable via OS command injection through custom-variable macros processed by the Nagios Remote Data Processor (NRDP). An attacker with valid NRDP access can embed shell metacharacters in a custom variable value that is later expanded inside a shell-executed command definition, causing arbitrary OS commands to run with the privileges of the Nagios process. No public exploit code or CISA KEV listing exists at time of analysis, but impact is rated high across confidentiality, integrity, and availability given full command execution on the monitoring server.

Technical ContextAI

The Nagios Remote Data Processor (NRDP) is a flexible data-transport mechanism that accepts passive check results, host status updates, and service data from remote agents. Nagios expands custom variable macros - identified by the $_HOSTxxx$, $_SERVICExxx$, and $_CONTACTxxx$ syntax - when constructing shell command strings for event handlers, notification commands, and check commands. When user-supplied values arriving via NRDP are placed into these macros without shell-safe quoting or sanitization, the result is passed directly to a shell interpreter, a textbook CWE-78 (Improper Neutralization of Special Elements in an OS Command) pattern. Affected products per CPE data are cpe:2.3:a:nagios_enterprises,_llc.:nagios_core and cpe:2.3:a:nagios_enterprises,_llc.:nagios_xi, covering all versions prior to the respective fixed releases.

RemediationAI

The primary fix is to upgrade Nagios Core to version 4.5.13 or later and Nagios XI to version 2026R1.5 or later, per the vendor advisory at https://www.nagios.com/security-disclosures/nagios-core/. If immediate patching is not feasible, the most effective compensating control is to audit all command object definitions and remove or sanitize any that reference custom variable macros ($_HOSTxxx$, $_SERVICExxx$, $_CONTACTxxx$) within shell-executed command strings - this eliminates the injection sink at the cost of losing that monitoring customization. As a secondary control, restrict NRDP endpoint access to known trusted IP ranges via firewall ACLs or the NRDP allowed_hosts configuration, which limits who can supply attacker-controlled macro values; note this does not remove the vulnerability but raises the bar for exploitation. Review the upstream Changelog at https://github.com/NagiosEnterprises/nagioscore/blob/master/Changelog for additional patch context.