CVE-2026-48552 Nagios Enterprises, LLC. CVE debrief

Who should care

Defenders responsible for Nagios Core and Nagios XI installations, especially those with user-interactive components, should assess exposure and prioritize verification of DOM-based XSS attacks.

Why it matters

CVE-2026-48552 is a DOM-based cross-site scripting vulnerability in Nagios Core and Nagios XI, allowing attackers to run arbitrary JavaScript in the victim's browser. Defenders should prioritize verifying exposure and assessing the feasibility of DOM-based XSS attacks.

• Potential for attackers to run arbitrary JavaScript in the victim's browser
• Possible impact on user sessions and sensitive data
• Need for sanitization of JSON string values in jsonquery.js
• Verification of exposure and feasibility of DOM-based XSS attacks

Technical summary

The vulnerability exists in jsonquery.js, where unencoded JSON string values reflected from stored fields are inserted into the DOM without sanitization, allowing attackers to run arbitrary JavaScript in the victim's browser. This DOM-based cross-site scripting vulnerability affects Nagios Core before 4.5.14 and Nagios XI before 2026R1.7. Defenders should prioritize verifying exposure of Nagios Core and Nagios XI installations, especially those with user-interactive components, and assess the feasibility of DOM-based XSS attacks.

Defensive priority

Defenders should prioritize verifying exposure of Nagios Core and Nagios XI installations, especially those with user-interactive components, and assess the feasibility of DOM-based XSS attacks.

Recommended defensive actions

• Verify Nagios Core and Nagios XI installations for exposure
• Assess the feasibility of DOM-based XSS attacks
• Implement sanitization for JSON string values in jsonquery.js
• Monitor for potential exploitation attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but the scope of affected versions and potential impact require further verification from official sources. Defenders should verify exposure of Nagios Core and Nagios XI installations, especially those with user-interactive components, and assess the feasibility of DOM-based XSS attacks. The vulnerability exists in jsonquery.js, where unencoded JSON string values reflected from stored fields are inserted into the DOM without sanitization.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.