CVE-2026-48550

Name of the Vulnerable Software and Affected Versions Nagios Core versions prior to 4.5.14 Nagios XI versions prior to 2026R1.7

Description Reflected cross-site scripting occurs in the 'cmd.cgi' endpoint via the NagFormId parameter. An unauthenticated remote attacker can craft a malicious link that, when followed by an authenticated user, executes arbitrary JavaScript in the victim's browser.

Recommendations Update Nagios Core to version 4.5.14 or later. Update Nagios XI to version 2026R1.7 or later. Avoid using the NagFormId parameter in the 'cmd.cgi' endpoint until the updates are applied.