CVE-2026-48553 is an OS command injection vulnerability in Nagios Core and Nagios XI. Authenticated attackers with access to the Nagios Remote Data Processor (NRDP) can inject OS commands through custom-variable macros when these variables are referenced in shell-executed command lines. This vulnerability requires that a custom variable be defined and referenced in a shell command, which is not the default configuration. The flaw affects Nagios Core versions prior to 4.5.13 and Nagios XI versions prior to 2026R1.5. The CVSS 4.0 base score is 7.7, indicating high severity.

An authenticated attacker with NRDP access can achieve remote code execution on the affected Nagios systems by injecting OS commands via custom-variable macros. This could lead to full system compromise depending on the privileges of the Nagios process. The attack requires a specific non-default configuration, limiting exposure to some extent.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid defining and referencing custom variables in shell-executed commands within NRDP configurations. Restrict NRDP access to trusted users only to reduce the risk of exploitation.