CVE-2026-48553

Name of the Vulnerable Software and Affected Versions Nagios Core versions prior to 4.5.13 Nagios XI versions prior to 2026R1.5

Description Authenticated remote code execution is possible via custom-variable macro injection through the Nagios Remote Data Processor (NRDP). This occurs when a custom variable defined on a host, service, or contact is referenced in a shell-executed command line, allowing an attacker with NRDP access to inject OS commands through the macro value. This issue requires a non-default configuration where a custom variable is both defined and referenced in a shell-executed command.

Recommendations Update Nagios Core to version 4.5.13 or later. Update Nagios XI to version 2026R1.5 or later.