PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-20915 Checkmk GmbH CVE debrief

CVE-2026-20915 is a Stored cross-site scripting (XSS) vulnerability in Checkmk version 2.5.0 (beta) before 2.5.0b2 that allows authenticated users with permission to create pending changes to inject malicious JavaScript into the Pending Changes sidebar. The injected JavaScript will execute in the browsers of other users viewing the sidebar. This issue has a CVSS score of 8.5 and a severity of HIGH. The vulnerability affects Checkmk deployments where users have permission to create pending changes. Users of Checkmk version 2.5.0 (beta) before 2.5.0b2 should be aware of this vulnerability and take steps to mitigate it.

Vendor
Checkmk GmbH
Product
Checkmk
CVSS
HIGH 8.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-03-31
Original CVE updated
2026-07-25
Advisory published
2026-03-31
Advisory updated
2026-07-25

Who should care

Users of Checkmk version 2.5.0 (beta) before 2.5.0b2, particularly those with permission to create pending changes, should be aware of this vulnerability and take steps to mitigate it. This includes updating to version 2.5.0b2 or later and restricting permissions to create pending changes to only trusted users. Security teams and platform operators should review their deployments and verify their configurations to ensure they are not exposed to this vulnerability.

Technical summary

The vulnerability is a stored cross-site scripting (XSS) issue in the Pending Changes sidebar of Checkmk. An authenticated user with permission to create pending changes can inject malicious JavaScript, which will be executed in the browsers of other users viewing the sidebar. The CVSS vector for this vulnerability is CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:H/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. This issue has a CVSS score of 8.5 and a severity of HIGH.

Defensive priority

High priority should be given to mitigating this vulnerability, as it allows for the injection of malicious JavaScript and has a high CVSS score.

Recommended defensive actions

  • Update Checkmk to version 2.5.0b2 or later
  • Restrict permissions to create pending changes to only trusted users
  • Monitor for suspicious activity in the Pending Changes sidebar
  • Review compensating controls for exposed systems while remediation is scheduled and verified
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record was published on 2026-03-31T15:16:11.527Z and was last modified on 2026-07-25T10:10:00.167Z. The NVD entry is currently Analyzed. This information is based on the NVD entry and the CVE record. The vulnerability affects Checkmk version 2.5.0 (beta) before 2.5.0b2. Users should verify their deployments and review the official advisory for mitigation steps.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-03-31T15:16:11.527Z and has not been modified since then. The NVD entry is currently Analyzed.