CVE-2026-48554
CVE-2026-48554 · Nagios Core / XI Authenticated RCE via Unfiltered NOTIFICATION-Family Macro Substitution
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 are vulnerable to authenticated remote code execution via unfiltered NOTIFICATION-family macro substitution through the com_data parameter. When a notification command references $NOTIFICATIONCOMMENT$ or $NOTIFICATIONAUTHOR$ in a shell-reachable position, authenticated UI users can run arbitrary commands as the nagios user. Exploitation requires a non-default configuration in which a notification command references these macros in a shell-executed command line.
CVSS 7.7 · High · EPSS 1.0% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
nagios core
- Versions
- ≥ 0, < 4.5.14: Affected (semver)
Update to 4.5.14
nagios xi
- Versions
- ≥ 0, < 2026R1.7: Affected (custom)
Update to 2026R1.7
nagios4 Debian:12
- Versions
- 4.4.6-4
- 4.4.6-4+deb12u1
- Affected ranges
- ECOSYSTEM: < 4.4.6-4+deb12u2
Update to 4.4.6-4+deb12u2
nagios4 Debian:13
- Versions
- 4.4.6-4.1
- 4.4.6-4.1+deb13u1
- Affected ranges
- ECOSYSTEM: < 4.4.6-4.1+deb13u2
Update to 4.4.6-4.1+deb13u2
nagios4 Debian:14
- Versions
- 4.4.6-4.1
- 4.5.12+ds-1
- Affected ranges
- ECOSYSTEM: < 4.5.14+ds-1
Update to 4.5.14+ds-1
nagios4 Ubuntu:20.04:LTS
- Versions
- 4.3.4-3
- 4.3.4-3ubuntu0.1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
nagios4 Ubuntu:22.04:LTS
- Versions
- 4.4.6-4
- 4.4.6-4ubuntu0.22.04.1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
nagios4 Ubuntu:24.04:LTS
- Versions
- 4.4.6-4
- 4.4.6-4ubuntu0.24.04.1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
nagios4 Ubuntu:26.10
- Versions
- 4.4.6-4.1ubuntu2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
nagios4 Ubuntu:26.04:LTS
- Versions
- 4.4.6-4.1ubuntu1
- 4.4.6-4.1ubuntu2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published