cbcvebase.
CVE-2026-8078
published 2026-06-08

CVE-2026-8078: Stored cross-site scripting in the global settings change log in Checkmk <2.5.0p5, <2.4.0p31, <2.3.0p48, and all 2.2.0 versions allows an administrator who can…

PriorityP420medium4.8CVSS 3.1
AVNACLPRHUIRSCCLILAN
EPSS
0.14%
3.9th percentile
Stored cross-site scripting in the global settings change log in Checkmk <2.5.0p5, <2.4.0p31, <2.3.0p48, and all 2.2.0 versions allows an administrator who can change global settings to store malicious HTML or JavaScript in changelog messages that executes in other users' browsers when they view the Activate Changes page or Audit log.

Affected

160 ranges· showing 25
VendorProductVersion rangeFixed in
checkmkcheckmk——
checkmkcheckmk——
checkmkcheckmk——
checkmkcheckmk——
checkmkcheckmk——
checkmkcheckmk——
checkmkcheckmk——
checkmkcheckmk——
checkmkcheckmk——
checkmkcheckmk——
checkmkcheckmk——
checkmkcheckmk——
checkmkcheckmk——
checkmkcheckmk——
checkmkcheckmk——
checkmkcheckmk——
checkmkcheckmk——
checkmkcheckmk——
checkmkcheckmk——
checkmkcheckmk——
checkmkcheckmk——
checkmkcheckmk——
checkmkcheckmk——
checkmkcheckmk——
checkmkcheckmk——

CVSS provenance

nvdv3.14.8MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
nvdv4.04.8MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.