Checkmk CVE-2026-8078

The attacker must hold administrator-level privileges on the Checkmk instance, specifically the ability to modify global settings and write changelog messages - this is the CVSS PR:H (high privileges required) condition. Exploitation is further limited by CVSS UI:P: a victim user must actively (or passively, via normal workflow) navigate to either the Activate Changes page or the Audit log after the payload has been stored. The vulnerability is specific to the global settings change log feature; other Checkmk components are not implicated. Non-administrative users cannot trigger the storage phase of this attack. Exploitation is constrained to the Checkmk web interface context - it does not provide OS-level access directly. The attack is entirely internal to the Checkmk application and does not cross scope boundaries (SC:N in the CVSS vector).

The CVSS 4.0 base score of 4.8 accurately reflects a constrained but real risk profile. The vector AV:N/AC:L/AT:N/PR:H/UI:P breaks down as follows: network-accessible attack surface with low complexity and no special configuration required, but gated behind high privilege (PR:H - administrator access) and requiring passive user interaction (UI:P - a victim must browse to the affected page). The impact metrics reinforce a limited severity: no confidentiality breach on the vulnerable system (VC:N), only low integrity impact locally (VI:L), and low secondary integrity impact (SI:L) - consistent with script-injection enabling defacement or session manipulation but not direct data exfiltration by itself. EPSS data was not provided in available intelligence, so exploitation probability cannot be quantified beyond what the CVSS signals. KEV status is negative - no confirmed active exploitation. No POC has been referenced. The net real-world priority is moderate-to-low for most organizations: this is an insider-abuse or post-compromise lateral-movement scenario rather than an external initial-access vector. The primary risk is a malicious or compromised admin using XSS to pivot to other authenticated user sessions within the Checkmk console.

An attacker who holds or has compromised Checkmk administrator credentials modifies a global configuration setting and embeds a JavaScript payload (e.g., a cookie-stealing script) inside the changelog message field. When a peer administrator or operator subsequently opens the Activate Changes page to review pending changes - a routine operational task - their browser silently executes the injected script, potentially exfiltrating their session token to an attacker-controlled endpoint. No public exploit code has been identified at time of analysis, but the technique requires no special tooling beyond a standard browser and admin access.