Nagios Core EUVD-2026-66598

The victim must be currently authenticated to Nagios Core with an active browser session and must be induced to visit or load a page under the attacker's control that triggers a cross-origin POST to cmd.cgi. The CSRF protection bypass is unconditional - no special server configuration is required beyond a standard Nagios Core web interface deployment running any version prior to 4.5.12. Exploitation is limited by the mandatory user interaction (UI:A in CVSS 4.0): the attacker cannot exploit this autonomously against passive victims. There is no confidentiality exposure; the attacker cannot read Nagios data, only submit commands. The attack is constrained to actions the victim user is authorized to perform within Nagios.

The CVSS 4.0 score of 6.9 with vector AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N reflects moderate-to-elevated real-world risk. The attacker requires no privileges (PR:N) and no special network position (AV:N), but active victim interaction is mandatory (UI:A), meaning the victim must visit a controlled page while holding an active Nagios session - this meaningfully constrains opportunistic, automated exploitation. EPSS data was not provided in the input, and this CVE is not currently listed in CISA KEV, so no confirmed active exploitation signal exists. The VI:H rating is warranted because successful exploitation allows arbitrary Nagios command execution - disabling monitoring, scheduling false downtime, or silencing alerts - which can undermine the integrity of an organization's entire monitoring posture. No conflicting signals are present between the CVSS vector and the description: both consistently indicate a network-delivered, interaction-dependent integrity attack. The absence of confidentiality and availability impact (VC:N/VA:N) keeps this from reaching critical severity, but the operational integrity consequence for teams relying on Nagios for alerting is non-trivial.

An attacker crafts a webpage containing a hidden HTML form that auto-submits a POST request to the target's Nagios cmd.cgi endpoint, specifying a destructive command such as disabling host notifications or acknowledging all alerts. When a Nagios administrator with an active session visits the attacker-controlled page - via phishing email or malicious link - the browser sends the forged request without including the NagFormId cookie, the broken validation logic accepts it, and the command executes under the administrator's session. No public proof-of-concept code has been identified, but the technique is straightforward for any attacker familiar with CSRF fundamentals.