PT-2025-44499
CVE-2024-13996
·
Published
2025-10-30
·
Updated
2026-10-02
Description by
CVSS 3.1
9.8
CriticalMetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions
Nagios XI versions prior to 2024R1.1.3
Description
Nagios XI did not properly invalidate all active sessions when a user's password was changed. This allowed existing sessions, potentially compromised, to remain valid after a credential update, enabling continued unauthorized access to user data and actions.
Recommendations
Update Nagios XI to version 2024R1.1.3 or later.
Found an issue in the description? Have something to add? Feel free to write us 👾