A compromised monitored host can send crafted agent output that controls where an HTML log is created.Checkmk says the resulting file placement can lead to arbitrary code execution. The NVD record identifies the execution context as the Checkmk site user, and Checkmk rates the issue CVSS 4.0 9.4 Critical.
What it allows
How Does CVE-2026-120495 Work?
Robotmk takes a test case name from monitored host agent data and uses it to create an HTML log folder. Checkmk says the final path was insufficiently validated, allowing a user-controlled HTML file outside its intended location.
The prerequisite is control of the Checkmk agent output on a monitored host. Checkmk says this usually requires root privileges on that host and a malicious agent plug-in or spool file.
The Robotmk service must also be added through automatic service discovery or confirmed manually by a monitoring administrator. NVD says crafted output can then define the HTML log's contents and location, leading to execution as the site user.
This flaw concerns the Robotmk test service and agent output from a monitored host. It is distinct from Checkmk's discovered host label synchronization issue, which involves a remote site in distributed monitoring.
What Is Known About CVE-2026-120495 Exploitation?
CISA KEV catalog version 2026.11.10 did not list CVE-2026-120495. That dated catalog status is not a determination about exploitation outside the catalog.
Who is affected
Which Checkmk Versions Are Affected?
NVD identifies Checkmk versions before 2.5.0p19 and before 2.4.0p40, plus the end-of-life 2.3.0 branch. Checkmk lists fixes in 2.5.0p19 and 2.4.0p40 for Pro, Ultimate, Cloud, and Ultimate MT editions.
Checkmk also lists 3.0.0b1 as not yet released in its Werk. The advisory does not list a supported fix for the 2.3.0 branch.
Exposure depends on a compromised monitored host and acceptance of the crafted Robotmk service. In our assessment, sites with automatic service discovery enabled merit particular attention because this step needs no manual administrator confirmation.
How Should Teams Assess the Risk?
Checkmk rates the flaw CVSS 4.0 9.4 Critical, but its exploitation prerequisites narrow the immediate exposure. Brandefense Blackhole counted two Telegram posts about this CVE between August 13 and November 11, 2026.
Those posts show discussion, not confirmed exploitation of a Checkmk site. Prioritize sites that monitor less trusted hosts and use automatic service discovery, then assess whether those hosts could supply altered agent output.
What Should Defenders Do?
Update affected 2.5 installations to 2.5.0p19 or later and affected 2.4 installations to 2.4.0p40 or later. Verify the installed version and edition against Checkmk's Werk, then plan migration from the end-of-life 2.3 branch.
As a Brandefense precaution, review which monitored hosts can supply Robotmk agent output. Investigate unexpected changes to agent plug-ins or spool files on those hosts and review newly discovered Robotmk services.
Checkmk says the fixed behavior keeps Robotmk HTML logs inside their intended directory. It also reports an UNKNOWN service state when an attempted log location falls outside that directory.
Use the vulnerability management guide to track affected sites and the vulnerability prioritization glossary to schedule remediation. The vulnerability management glossary explains the broader process.
Timeline
- 2026-11-02
Checkmk dated Werk #22624, describing the Robotmk HTML log security fix.
- 2026-11-11
NVD published the CVE-2026-120495 record.
What to do
-
Inventory Robotmk exposure
Identify Checkmk sites monitoring hosts that supply Robotmk agent output. Check whether automatic service discovery is enabled for those hosts.
-
Install fixed releases
Update affected 2.5 sites to 2.5.0p19 or later and affected 2.4 sites to 2.4.0p40 or later. Verify installed versions.
-
Migrate the 2.3 branch
Plan migration from end-of-life Checkmk 2.3.0. Checkmk's Werk does not list a supported 2.3 fix.
-
Review host and service changes
As a Brandefense precaution, investigate unexpected agent plug-in or spool-file changes and newly discovered Robotmk services.
What Brandefense can do
- Scan your domain in Brandefense Atlas, free
Atlas checks public sources for leaked credentials, phishing domains, dark web mentions and data sales, then gives your domain a risk grade. Free, no sign-up.
- Vulnerability intelligence platform
Brandefense Vulnerability Intelligence follows which vulnerabilities attackers are using, so your team can patch what is under attack first.
Frequently Asked Questions
What is CVE-2026-120495?
It is a path traversal flaw in Checkmk's Robotmk test service. Crafted agent output from a compromised monitored host can lead to code execution as the site user.
Does CVE-2026-120495 require a compromised host?
Yes. Checkmk says an attacker must alter Checkmk agent output on a monitored host, which usually requires root privileges there.
Which Checkmk releases fix CVE-2026-120495?
Checkmk lists 2.5.0p19 and 2.4.0p40 as fixed releases. Its advisory lists 2.3.0 as end of life.
Does automatic service discovery matter?
Yes. Checkmk says the crafted Robotmk service must be added by automatic discovery or confirmed manually by a monitoring administrator.
Is CVE-2026-120495 in CISA KEV?
CISA KEV catalog version 2026.11.10 did not list this CVE. That status does not establish whether exploitation has occurred elsewhere.
Sources
- Werk #22624: Code execution through Robotmk HTML log test serviceCheckmk
- CVE-2026-120495 DetailNational Vulnerability Database
- Known Exploited Vulnerabilities CatalogCybersecurity and Infrastructure Security Agency
