[ CVE-2026-14452 · Published 16 Oct 2026 ]

Vulnerability in Checkmk GmbH Checkmk

CVSS 8.6 EPSS <1%1 agency advisoryNo fix listed yet

[ Description ]Official description

Improper validation of the reset_url parameter of the Setup in-page search in Checkmk <2.5.0p15, <2.4.0p38, <2.3.0p51 and 2.2.0 (EOL) allows an attacker to execute arbitrary script in the session of an authenticated user with Setup access, or to redirect that user to an arbitrary external site, by tricking the user into opening a crafted URL and clicking the Reset button or submitting an empty search.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ Advisories ]Government CERT advisories

BSI CERT-Bund5 Oct 2026WID-SEC-2026-3746

Checkmk: Multiple vulnerabilities Translated from German
CVE-2026-14452CVE-2026-92878CVE-2026-92882

[ References ]References

checkmk.com/werk/22314

[ Facts ]Key facts

CVE: CVE-2026-14452
EUVD: EUVD-2026-102834
Published: 16 Oct 2026, 10:18 UTC
Updated: 16 Oct 2026, 11:17 UTC
NVD status: Deferred
CVSS 4.0: 8.6 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Scored by security@checkmk.com
EPSS: 0.29% chance of exploitation in 30 days · higher than 21% of CVEs
CISA SSVC: Exploitation: none · Automatable: no · Impact: total
Weakness: CWE-601

[ Affected ]Affected products

Checkmk GmbH Checkmk2.5.0 – < 2.5.0p15, 2.4.0 – < 2.4.0p38, 2.3.0 – < 2.3.0p51, 2.2.0

[ Description ]Official description

[ Fixes ]Fixes and patches

[ Advisories ]Government CERT advisories

Checkmk: Multiple vulnerabilities Translated from German

[ References ]References