PT-2026-47286 · Checkmk Gmbh · Checkmk

Published 2026-06-08 · Updated 2026-06-08 · CVE-2026-8078

Mitre

CVSS v4.0

4.8

Medium

Base vector

AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N

Stored cross-site scripting in the global settings change log in Checkmk <2.5.0p5, <2.4.0p31, <2.3.0p48, and all 2.2.0 versions allows an administrator who can change global settings to store malicious HTML or JavaScript in changelog messages that executes in other users' browsers when they view the Activate Changes page or Audit log.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-8078

Affected Products

Checkmk

References · 2

• https://nvd.nist.gov/vuln/detail/CVE-2026-8078 · Security Note
• https://checkmk.com/werk/17992 · Vendor Advisory