CVE-2026-48554 Nagios Core / XI Authenticated RCE via Unfiltered NOTIFICATION-Family Macro Substitution
Authenticated users can execute arbitrary commands as the nagios user if notification macros are used in shell commands.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-48554?
CVE-2026-48554 is a high-severity command injection vulnerability in Nagios Core, published on 12 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 are vulnerable to authenticated remote code execution via unfiltered NOTIFICATION-family macro substitution through the com_data parameter. When a notification command references $NOTIFICATIONCOMMENT$ or $NOTIFICATIONAUTHOR$ in a shell-reachable position, authenticated UI users can run arbitrary commands as the nagios user. Exploitation requires a non-default configuration in which a notification command references these macros in a shell-executed command line.
Weakness: CWE-78
Which versions are affected by CVE-2026-48554?
How do I fix CVE-2026-48554?
Upgrade to a fixed version.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-48554 being exploited?
There is no known exploitation of CVE-2026-48554 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-48554, GHSA-f3vr-3658-6fxw, UBUNTU-CVE-2026-48554.