This vulnerability involves improper neutralization of input during web page generation (CWE-79) in Checkmk's service discovery active check output. An authorized administrator can inject malicious scripts via active or custom checks, which are then stored and executed in the browsers of other users with appropriate permissions when they access the service discovery page. The issue affects multiple versions of Checkmk prior to specific patch levels. The CVSS 4.0 vector indicates network attack vector, low attack complexity, high privileges required, user interaction needed, and limited impact on confidentiality and integrity.

Successful exploitation allows an administrator to inject and execute malicious scripts in the browsers of other administrators or users with host read permissions. This could lead to actions performed in the context of the victim's session, potentially exposing sensitive information or enabling further attacks within the application. However, the impact is limited by the requirement for high privileges to inject the payload and user interaction to trigger execution. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrator permissions to trusted users only and monitor for suspicious activity related to active or custom checks. Avoid running untrusted checks or scripts in the service discovery page. Follow vendor updates closely for any forthcoming patches or official mitigations.