PatchTheCEVcheckmk vulnerabilities
Recent CVEs affecting checkmk products. 12 tracked.
checkmk has 12 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 4. Most recent: 2026-06-08. Highest priority: CVE-2025-39664 (score 41/100).
- CVE-2026-33456 HIGH 7.6 DOWNGRADE Livestatus injection in the notification test mode in Checkmk <2.5.0b4 and <2.4.0p26 allows an authenticated u
- CVE-2024-47091 HIGH 7.8 DOWNGRADE Privilege escalation in the mk_mysql agent plugin on Windows in Checkmk <2.4.0p29, <2.3.0p47, and 2.2.0 (EOL)
- CVE-2023-22348 MEDIUM 4.3 DOWNGRADE UPGRADE Improper Authorization in RestAPI in Checkmk GmbH's Checkmk versions <2.1.0p28 and <2.2.0b8 allows remote auth
- CVE-2023-23548 MEDIUM 5.4 UPGRADE Reflected XSS in business intelligence in Checkmk <2.2.0p8, <2.1.0p32, <2.0.0p38, <=1.6.0p30.
- CVE-2026-33457 MEDIUM 6.3 DOWNGRADE Livestatus injection in the prediction graph page in Checkmk <2.5.0b4, <2.4.0p26, and <2.3.0p47 allows an auth
- CVE-2025-39664 MEDIUM 6.5 UPGRADE Insufficient escaping in the report scheduler within Checkmk <2.4.0p13, <2.3.0p38, <2.2.0p46 and 2.1.0 (EOL) a
- CVE-2026-7765 MEDIUM 5.3 DOWNGRADE Incorrect authorization in the User Messages dashboard widget in Checkmk <2.5.0p5 causes the message-fetching
- CVE-2026-7186 MEDIUM 5.4 DOWNGRADE Stored cross-site scripting in the URL dashboard widget in Checkmk <2.5.0p5, <2.4.0p31, <2.3.0p48, and all 2.2
- CVE-2026-8078 MEDIUM 4.8 DOWNGRADE Stored cross-site scripting in the global settings change log in Checkmk <2.5.0p5, <2.4.0p31, <2.3.0p48, and a
- CVE-2026-9549 MEDIUM 4.8 DOWNGRADE Stored cross-site scripting in the service discovery active check output in Checkmk <2.5.0p5, <2.4.0p31, <2.3.
- CVE-2025-32916 MEDIUM 4.3 UPGRADE Potential use of sensitive information in GET requests in Checkmk GmbH's Checkmk versions <2.4.0p13, <2.3.0p38
- CVE-2026-8833 MEDIUM 5.4 DOWNGRADE Improper neutralization of HTML-encoded characters in the URL validation function in Checkmk <2.5.0p5, <2.4.0p
FAQ
How do I fix checkmk vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is checkmk being exploited right now?
None of the tracked checkmk CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which checkmk CVE should I patch first?
CVE-2025-39664 currently ranks highest (41/100): Insufficient escaping in the report scheduler within Checkmk <2.4.0p13, <2.3.0p38, <2.2.0p46 and 2.1.0 (EOL) a.