CVE-2025-39666 omd: Local privilege escalation when executing omd commands as root

What is CVE-2025-39666?

CVE-2025-39666 is a critical vulnerability in Checkmk Checkmk, published on 7 Apr 2026. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Local privilege escalation in Checkmk 2.2.0 (EOL), Checkmk 2.3.0 before 2.3.0p46, Checkmk 2.4.0 before 2.4.0p25, and Checkmk 2.5.0 (beta) before 2.5.0b3 allows a site user to escalate their privileges to root, by manipulating files in the site context that are processed when the `omd` administrative command is run by root.

Weakness: CWE-829, CWE-426

Which versions are affected by CVE-2025-39666?

It affects 1 product.

Products include Checkmk Checkmk.

How do I fix CVE-2025-39666?

No fix has been published for CVE-2025-39666 yet. Limit exposure of the affected software until one is available.

Is CVE-2025-39666 being exploited?

There is no known exploitation of CVE-2025-39666 in the wild and no public exploit code.

Other vulnerabilities in Checkmk Checkmk

• CVE-2024-8606 Fix 2FA bypass via RestAPI Critical 9.2
• CVE-2022-46836 PHP code injection in watolib Critical 9.1
• CVE-2025-32919 Privilege Escalation in Windows License plugin for Checkmk Windows Agent High 8.8
• CVE-2024-28827 Privilege escalation in Windows agent High 8.8
• CVE-2024-28828 1-Click compromize via CSRF High 8.8

All Checkmk Checkmk vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-6x92-c6pf-4wm2, UBUNTU-CVE-2025-39666.