Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 are vulnerable to authenticated remote code execution via unfiltered NOTIFICATION-family macro substitution through the com_data parameter. When a notification command references $NOTIFICATIONCOMMENT$ or $NOTIFICATIONAUTHOR$ in a shell-reachable position, authenticated UI users can run arbitrary commands as the nagios user. Exploitation requires a non-default configuration in which a notification command references these macros in a shell-executed command line.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-48554 Authenticated RCE in Nagios Core and XI via Macro Substitution https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-48554
Post summary
CVE-2026-48554 is an authenticated remote code execution flaw in Nagios Core and XI exploiting macro substitution; only basic details are supplied, with no exploit, patch, or active use evidence mentioned.