CVE-2026-48551

HighCVSS 7.4/10Last modified Sep 8, 2026

Description

Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 contain a cross-site request forgery protection bypass via a self-supplied double-submit cookie. An attacker can supply matching cookie and request parameter values to bypass CSRF protection, enabling unauthenticated attackers to run commands as authorized users via malicious links.

Metrics

CVSS 3.1 7.4/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N

Weakness enumeration

CWE-352

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
Nagios Enterprises, LLC.	Nagios Core	< 4.5.14
Nagios Enterprises, LLC.	Nagios XI	< 2026R1.7

References

Timeline

Published: Aug 12, 2026
Last modified: Sep 8, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-485525.4Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 are vulnerable to DOM-based cross-site scripting in jsonquery.js. Unencoded JSON str CVE-2026-485537.5Nagios Core before 4.5.13 and Nagios XI before 2026R1.5 are vulnerable to authenticated remote code execution via custom-variable macro inje CVE-2026-485547.5Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 are vulnerable to authenticated remote code execution via unfiltered NOTIFICATION-fa CVE-2026-485557.4Spatie Laravel Media Library before version 11.23.0 contains a server-side request forgery vulnerability that allows remote attackers to cau CVE-2026-485578.8Spatie Laravel Media Library before version 11.23.0 contains a file upload restriction bypass in FileAdder::defaultSanitizer(). The sanitize CVE-2026-4855810.0SimpleHelp versions 5.5.15 and prior and 6.0 pre-release versions contain an authentication bypass vulnerability in the OIDC authentication CVE-2026-485595.4Lightweight Music Server (LMS) though 3.76.0 contains a stored cross-site scripting vulnerability that allows attackers to execute arbitrary CVE-2026-485605.4Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.CVE-2026-485619.6Improper neutralization of special elements used in a command ('command injection') in Copilot Chat (Microsoft Edge) allows an unauthorized CVE-2026-485624.6Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized att CVE-2026-485637.5Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.CVE-2026-485648.8Heap-based buffer overflow in Windows DHCP Server allows an authorized attacker to execute code over a network.