CVE-2025-39663

Cross-Site Scripting (XSS) vulnerability in Checkmk's distributed monitoring allows a compromised remote site to inject malicious HTML code into service outputs in the central site. Affecting Checkmk before 2.4.0p14, 2.3.0p39, 2.2.0 and 2.1.0 (eol).

CVSS 4.0

8.5CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CVSS 3.1

8.4CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H

EPSS

0.6% chance of exploitation in the next 30 days; higher than 48% of CVEs (scores of 2026-10-25)

CWEs

CWE-79, CWE-80

Published

2025-10-30

Modified

2026-10-19

Record from

the NVD, synced 2026-10-19

Affected

• checkmk:checkmk

References

• https://checkmk.com/werk/17998
• https://github.com/sbaresearch/advisories/tree/82fd27e4570433464c30b35150b197db9a850f4e/2025/SBA-ADV-20250729-01_Checkmk_Cross_Site_Scripting
• http://seclists.org/fulldisclosure/2025/Nov/0
• https://github.com/sbaresearch/advisories/tree/82fd27e4570433464c30b35150b197db9a850f4e/2025/SBA-ADV-20250729-01_Checkmk_Cross_Site_Scripting

Check your stackJSON