CVE-2025-39663 Cross Site Scripting through compromised remote site
A compromised remote site can inject malicious HTML into service outputs on the central Checkmk monitoring server, potentially affecting administrators.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2025-39663?
CVE-2025-39663 is a high-severity cross-site scripting vulnerability in Checkmk Checkmk, published on 30 Oct 2025. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
Cross-Site Scripting (XSS) vulnerability in Checkmk's distributed monitoring allows a compromised remote site to inject malicious HTML code into service outputs in the central site. Affecting Checkmk before 2.4.0p14, 2.3.0p39, 2.2.0 and 2.1.0 (eol).
Which versions are affected by CVE-2025-39663?
It affects 1 product.
Products include Checkmk Checkmk.
How do I fix CVE-2025-39663?
No fix has been published for CVE-2025-39663 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2025-39663 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-39663 exists.
Other vulnerabilities in Checkmk Checkmk
- CVE-2025-39666 omd: Local privilege escalation when executing omd commands as root
- CVE-2024-8606 Fix 2FA bypass via RestAPI
- CVE-2022-46836 PHP code injection in watolib
- CVE-2025-32919 Privilege Escalation in Windows License plugin for Checkmk Windows Agent
- CVE-2024-28827 Privilege escalation in Windows agent
Sources
Also known as GHSA-m8fq-fxf8-wxx3, UBUNTU-CVE-2025-39663.