CVE-2026-48548: Nagios Enterprises, Llc Nagios Core

Medium severity, CVSS 6.5. EPSS: 0.2% chance of exploitation in the next 30 days.

Nagios Core before 4.5.12 contains a cross-site request forgery vulnerability in cmd.cgi where the CSRF protection mechanism passes validation when the NagFormId cookie is absent. Attackers can craft a malicious cross-site POST request to execute arbitrary Nagios commands as a currently authenticated user without their knowledge or consent.

Affected products

• Nagios Enterprises, Llc Nagios Core: before 4.5.12 (fixed in 4.5.12)

Published 2026-08-26. Last modified 2026-09-24.