Is CVE-2026-48550 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-48550?

CVE-2026-48550 has a CVSS v3 severity of MEDIUM (6.1).

Back

CVE-2026-48550

Description

Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 are vulnerable to reflected cross-site scripting in cmd.cgi via the NagFormId parameter. An unauthenticated remote attacker can craft a malicious link that, when followed by an authenticated user, executes arbitrary JavaScript in the victim's browser.