CVE-2026-48554
Received Received - Intake

Authenticated Remote Code Execution in Nagios Core and Nagios XI via Macro Substitution

Publication date: 2026-08-12

Last updated on: 2026-08-12

Assigner: VulnCheck

Description
Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 are vulnerable to authenticated remote code execution via unfiltered NOTIFICATION-family macro substitution through the com_data parameter. When a notification command references $NOTIFICATIONCOMMENT$ or $NOTIFICATIONAUTHOR$ in a shell-reachable position, authenticated UI users can run arbitrary commands as the nagios user. Exploitation requires a non-default configuration in which a notification command references these macros in a shell-executed command line.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-12
Last Modified
2026-08-12
Generated
2026-08-12
AI Q&A
2026-08-12
EPSS Evaluated
N/A
NVD
CVE-2026-48554
EUVD
EUVD-2026-57346

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
nagios nagios_core to 4.5.14 (exc)
nagios nagios_xi to 2026R1.7 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-48554 is an authenticated remote code execution vulnerability in Nagios Core before 4.5.14 and Nagios XI before 2026R1.7. It occurs when notification commands use unfiltered NOTIFICATION-family macros like $NOTIFICATIONCOMMENT$ or $NOTIFICATIONAUTHOR$ in shell-reachable positions. Authenticated users can exploit this to run arbitrary commands as the nagios user.

Detection Guidance

Check Nagios Core versions before 4.5.14 and Nagios XI before 2026R1.7 using version commands like 'nagios -v' or 'rpm -qa | grep nagios'. Inspect notification command configurations for unfiltered $NOTIFICATIONCOMMENT$ or $NOTIFICATIONAUTHOR$ macros in shell-reachable positions.

Impact Analysis

If exploited, this vulnerability allows attackers with valid credentials to execute arbitrary commands on the Nagios server as the nagios user. This could lead to full system compromise, data theft, or disruption of monitoring services.

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating GDPR and HIPAA requirements for data protection and access controls. Organizations may face compliance penalties and reputational damage if exploited.

Mitigation Strategies

Upgrade Nagios Core to 4.5.14 or later and Nagios XI to 2026R1.7 or later. Remove or filter $NOTIFICATIONCOMMENT$ and $NOTIFICATIONAUTHOR$ macros from shell-executed notification commands. Restrict UI user permissions to prevent unauthorized macro usage.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-48554. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart