CVE-2023-53689: Nagios Fusion

Medium severity, CVSS 4.8. EPSS: 0.9% chance of exploitation in the next 30 days.

Nagios Fusion versions prior to 4.2.0 contain a reflected cross-site scripting (XSS) vulnerability in the license key configuration flow that can result in execution of attacker-controlled script in the browser of a user who follows a crafted URL. While the application server itself is not directly corrupted by the reflected XSS, the resulting browser compromise can lead to credential/session theft and unauthorized administrative actions.

Affected products

• Nagios Fusion: before 4.2.0 (fixed in 4.2.0)

Published 2025-10-30. Last modified 2026-06-17.