This vulnerability is a stored cross-site scripting (CWE-79) issue affecting Checkmk monitoring software. An administrator who can modify global settings can insert malicious scripts into the global settings change log. When other users access the Activate Changes page or Audit log, the injected script executes in their browsers, potentially leading to unauthorized actions or data exposure within the context of the affected application session. The vulnerability affects multiple versions of Checkmk prior to specific patch levels, but no official fix or patch has been confirmed yet.

The impact is limited to users who have access to view the Activate Changes page or Audit log in the affected Checkmk versions. The vulnerability allows execution of arbitrary HTML or JavaScript in the context of the victim's browser session, which could lead to session hijacking, unauthorized actions, or data disclosure within the application. However, exploitation requires an administrator-level user to first inject the malicious content, limiting the attack vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict administrative access to trusted personnel only and monitor for suspicious changes in the global settings changelog. Avoid viewing the Activate Changes page or Audit log from untrusted environments. Follow vendor communications closely for updates on patches or official mitigations.