CVE-2026-61550: Icinga ICINGA2

Critical severity, CVSS 9.8. EPSS: 0.7% chance of exploitation in the next 30 days.

Icinga 2 is an open source monitoring system. From 2.8 until 2.14.9, 2.15.4, and 2.16.2, certificate update JSON-RPC message handling does not validate that the sender is a trusted endpoint. An unauthenticated network attacker able to connect to TCP port 5665 can replace the node certificate and trusted CA certificate, impersonate a trusted node, and take control of the node. This issue is fixed in versions 2.14.9, 2.15.4, and 2.16.2.

Affected products

• Icinga ICINGA2: from 2.8, before 2.14.9 (fixed in 2.14.9); from 2.15.0, before 2.15.4 (fixed in 2.15.4); from 2.16.0, before 2.16.2 (fixed in 2.16.2)

Published 2026-09-18. Last modified 2026-09-24.