CVE-2026-9549

Name of the Vulnerable Software and Affected Versions Checkmk versions prior to 2.5.0p5 Checkmk versions prior to 2.4.0p31 Checkmk versions prior to 2.3.0p48 Checkmk versions 2.2.0

Description Stored cross-site scripting occurs in the service discovery active check output. This allows an administrator capable of configuring active or custom checks to inject malicious HTML or JavaScript into the check output. The injected code executes in the browser of an administrator or a user with host read permissions when they access the service discovery page.

Recommendations Update to version 2.5.0p5 or newer. Update to version 2.4.0p31 or newer. Update to version 2.3.0p48 or newer. At the moment, there is no information about a newer version that contains a fix for this vulnerability.