Checkmk: updates fix critical code injection vulnerabilities

What happened

On 12 November 2026, updates for the Checkmk monitoring software were published. They fix several vulnerabilities rated as critical that allow attackers to inject malicious code. The available reports do not give technical details, CVE IDs or a list of affected and fixed versions.

There are no reports of active exploitation so far. Monitoring servers are still an attractive target because they usually hold credentials and have network access to many other systems. For that reason the update should not wait for the next regular maintenance window.

Who is affected

This affects administrators who run Checkmk on their own servers. The source data does not say exactly which editions or versions are affected. Check the Checkmk vendor advisory and release notes (Werks) to find out whether your version is affected and which release fixes it.

If you do not run Checkmk, you are not affected by this issue.

What to do now

1. Find out which Checkmk version each of your sites runs (see the next section).
2. Look up the affected and fixed versions for your version line in the Checkmk advisory or release notes.
3. Until the update is installed, limit access to the Checkmk web interface to trusted networks or a VPN where you can.
4. Back up each site before the update, for example with omd backup <site> /path/to/backup.tar.gz.
5. Install the fixed Checkmk package for your distribution, then switch each site to the new version: omd stop <site>, omd update <site>, omd start <site>.
6. Check that the site is running (omd status <site>), that you can log in to the web interface, and that checks and notifications work normally.
7. Repeat this on all Checkmk servers, including any remote sites in a distributed setup.

How to check whether you are affected

• Run omd versions to list installed Checkmk versions and omd sites to see which version each site uses. You can also see the version in the web interface under Help > Info.
• Compare these versions with the fixed releases in the vendor advisory. Any site running an older release in its version line should be updated.
• If your Checkmk web interface was reachable from the internet, review the web server and Checkmk logs for unusual requests or logins, and check for configuration changes you did not make.

Sources

• https://www.heise.de/news/Monitoring-Software-Checkmk-Updates-schliessen-kritische-Codeschmuggel-Lecks-11522043.html