CVE-2026-48554
Nagios Core / XI Authenticated RCE via Unfiltered NOTIFICATION-Family Macro Substitution
CVSS Score
7.5
EPSS Score
0.0%
EPSS Percentile
0th
Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 are vulnerable to authenticated remote code execution via unfiltered NOTIFICATION-family macro substitution through the com_data parameter. When a notification command references $NOTIFICATIONCOMMENT$ or $NOTIFICATIONAUTHOR$ in a shell-reachable position, authenticated UI users can run arbitrary commands as the nagios user. Exploitation requires a non-default configuration in which a notification command references these macros in a shell-executed command line.
| CWE | CWE-78 |
| Vendor | nagios enterprises, llc. |
| Product | nagios core |
| Published | Aug 12, 2026 |
| Last Updated | Aug 12, 2026 |
Stay Ahead of the Next One
Get instant alerts for nagios enterprises, llc. nagios core
Be the first to know when new high vulnerabilities affecting nagios enterprises, llc. nagios core are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H Attack Vector
Network
Attack Complexity
High
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Affected Versions
Nagios Enterprises, LLC. / Nagios Core
0 < 4.5.14
Nagios Enterprises, LLC. / Nagios XI
0 < 2026R1.7
References
Credits
Zach Hanley of Horizon3.ai