https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-24413.htmlhttps://patchthecve.com/cve/CVE-2026-24413.htmlWed, 17 Jun 2026 10:23:01 +0000MEDIUM 5.5: Icinga 2 is an open source monitoring system. Starting in version 2.3.0 and prior to versions 2.13.14, 2.14.8, and 2.15.2, the Icinga 2 MSI did not set appropriate permissions for the `%ProgramData%\icinga2\var` folder on Windows. This resulted in the its contents - including the private key of the https://patchthecve.com/cve/CVE-2025-61909.htmlhttps://patchthecve.com/cve/CVE-2025-61909.htmlFri, 09 Oct 2026 10:10:00 +0000MEDIUM 4.4: Icinga 2 is an open source monitoring system. From 2.10.0 to before 2.15.1, 2.14.7, and 2.13.13, the safe-reload script (also used during systemctl reload icinga2) and logrotate configuration shipped with Icinga 2 read the PID of the main Icinga 2 process from a PID file writable by the daemon user,https://patchthecve.com/cve/CVE-2025-61908.htmlhttps://patchthecve.com/cve/CVE-2025-61908.htmlFri, 09 Oct 2026 10:10:00 +0000MEDIUM 6.5: Icinga 2 is an open source monitoring system. From 2.10.0 to before 2.15.1, 2.14.7, and 2.13.13, when creating an invalid reference, such as a reference to null, dereferencing results in a segmentation fault. This can be used by any API user with access to an API endpoint that allows specifying a fihttps://patchthecve.com/cve/CVE-2025-61907.htmlhttps://patchthecve.com/cve/CVE-2025-61907.htmlFri, 09 Oct 2026 10:10:00 +0000MEDIUM 6.5: Icinga 2 is an open source monitoring system. In Icinga 2 versions 2.4 through 2.15.0, filter expressions provided to the various /v1/objects endpoints could access variables or objects that would otherwise be inaccessible for the user. This allows authenticated API users to learn information that shttps://patchthecve.com/cve/CVE-2025-48057.htmlhttps://patchthecve.com/cve/CVE-2025-48057.htmlWed, 17 Jun 2026 09:29:04 +0000CRITICAL 9.8: Icinga 2 is a monitoring system which checks the availability of network resources, notifies users of outages, and generates performance data for reporting. Prior to versions 2.12.12, 2.13.12, and 2.14.6, the VerifyCertificate() function can be tricked into incorrectly treating certificates as validhttps://patchthecve.com/cve/CVE-2024-49369.htmlhttps://patchthecve.com/cve/CVE-2024-49369.htmlWed, 17 Jun 2026 07:59:46 +0000CRITICAL 9.8: Icinga is a monitoring system which checks the availability of network resources, notifies users of outages, and generates performance data for reporting. The TLS certificate validation in all Icinga 2 versions starting from 2.4.0 was flawed, allowing an attacker to impersonate both trusted cluster