Checkmk Critical XSS Vulnerabilities

CERT-Bund published advisory WID-SEC-2026-0928 disclosing multiple critical XSS vulnerabilities in Checkmk monitoring software. The vulnerabilities allow remote attackers to execute malicious scripts. Affected versions include Checkmk prior to 2.6.0b1 and 2.5.0b2, running on Linux and UNIX systems. The CVSS Base Score is 9.0 (critical) with a Temporal Score of 7.8 (high).

Organizations running Checkmk deployments should verify their installed versions and apply available patches to upgrade to a secure version. As this is a critical vulnerability with remote attack capability, patching should be prioritized. No specific compliance deadline is stated in the advisory; organizations should treat this as requiring immediate attention.