PT-2026-21297 · Nagios+2 · Nagios+3

H00Die-Gr3Y · Published 2026-02-20 · Updated 2026-02-20 · CVE-2026-24892

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions openITCOCKPIT Community Edition versions prior to 5.3.1

Description openITCOCKPIT is a monitoring tool compatible with Nagios, Naemon, and Prometheus. The software contains an unsafe PHP deserialization pattern when handling changelog entries. Specifically, serialized changelog data originating from attacker-controlled application state is deserialized without class restrictions. While no current application endpoint directly introduces PHP objects into this data path, the unrestricted use of unserialize() creates a potential PHP object injection issue. Future modifications, plugins, or refactoring that introduce object values into this path could lead to immediate exploitability, potentially resulting in remote code execution.

Recommendations Update to a version newer than 5.3.1.

Exploit

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2026-24892

GHSA-G83P-VVJM-G39X

Affected Products

Naemon

Nagios

Prometheus

Openitcockpit Community Edition

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24892.json · Exploit
• https://github.com/openITCOCKPIT/openITCOCKPIT/commit/975e0d0dfb79898568afbbfdba8f647d92612a69 · Patch
• https://github.com/openITCOCKPIT/openITCOCKPIT/security/advisories/GHSA-g83p-vvjm-g39x · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-24892 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-24892 · Security Note
• https://github.com/openITCOCKPIT/openITCOCKPIT/releases/tag/openITCOCKPIT-5.4.0 · Note
• https://twitter.com/CVEnew/status/2024988759423680681 · Twitter Post