Have you patched Checkmk for the 11 November security release?
Checkmk published stable releases 2.5.0p19 and 2.4.0p40 on 11 November 2026, after a 6 November pre-announcement, to fix three Critical issues: CVE-2026-118965, CVE-2026-120495 and CVE-2026-121374. Checkmk rates each CVSS 4.0 9.4. Each needs a foothold, such as a remote site, control of agent output, or a user who can edit rules. Affected are 2.5.0 before p19, 2.4.0 before p40, and 2.3.0, which is end of life and has no fix. Upgrade now.
Not in CISA KEV when checked on 11 November 2026. Each issue needs a foothold.
Checkmk has published no indicators of compromise, and says nothing either way about exploitation. CVE-2026-118965, CVE-2026-120495 and CVE-2026-121374 were not in CISA's Known Exploited Vulnerabilities catalogue when we checked at 13:06 GMT on 11 November 2026 (catalogue 2026.11.10, released at 19:03 UTC on 10 November, before this release). Recheck KEV. Upgrade Checkmk 2.5.0 to 2.5.0p19 and 2.4.0 to 2.4.0p40. Checkmk 2.3.0 is end of life and will not receive a fix.
By Simon Phillips, CTO. Reviewed by Oliver Legg, Head of SOC and IR. Last updated 11 November 2026, 13:29 GMT.
At a Glance
Based on Checkmk werks 22120, 22624 and 17994, the official 11 November 2026 release posts, the 6 November pre-announcement, the official CVE and NVD records, and CISA KEV, as of 11 November 2026. Last updated 11 November 2026, 13:29 GMT.
Critical, CVSS 4.0 9.4
Checkmk rates all three issues Critical, CVSS 4.0 9.4, with vector CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H. The official CVE records (CNA: Checkmk) use the same score and vector. The NVD records were in Deferred status when we checked and show that Checkmk score as Secondary. NVD has not published its own scores.
No IOCs; Checkmk is silent on exploitation
Checkmk has published no indicators of compromise, and says nothing either way about exploitation. Not in CISA KEV when checked at 13:06 GMT on 11 November 2026 (catalogue 2026.11.10, which predates this release).
2.5.0, 2.4.0 and 2.3.0 (EOL)
Checkmk 2.5.0 before p19, 2.4.0 before p40, and 2.3.0, which is end of life. The 6 November pre-announcement says all editions are affected by the security patch. Werk 22624 and both release posts put CVE-2026-120495 (Robotmk) in commercial editions only. We follow the werk. The other two issues are listed for all editions.
2.5.0p19 or 2.4.0p40
Checkmk: upgrade to 2.5.0p19 or 2.4.0p40, and move off 2.3.0 or older. Checkmk lists no workaround. Before applying the security patch, Checkmk recommends updating to 2.5.0p18 or 2.4.0p39 first, to reduce the risk of unrelated breaking changes. That is a recommendation, not a requirement.
Checkmk werk 22120 is dated 29 October 2026. That is the werk write date, not the public release date.
Checkmk werk 22624 is dated 2 November 2026. That is the werk write date, not the public release date.
Checkmk werk 17994 is dated 3 November 2026. That is the werk write date, not the public release date.
Checkmk pre-announces that it will publish 2.4.0p40 and 2.5.0p19 on 11 November, for three Critical Remote Code Execution issues rated 9.4, and names the three werks and CVE IDs.
Checkmk publishes the official forum posts for stable releases 2.5.0p19 (10:43:37 UTC) and 2.4.0p40 (10:43:49 UTC). Those posts list the three security werks.
The official CVE records for CVE-2026-121374, CVE-2026-120495 and CVE-2026-118965 are published (CNA: Checkmk).
The NVD records are published, in Deferred status, and show Checkmk's CVSS 4.0 9.4. NVD has not scored them itself.
The three CVEs are not in CISA KEV catalogue 2026.11.10 (released at 19:03 UTC on 10 November, before this release). Recheck KEV.
The three Critical issues
Scores and versions follow Checkmk's werks and the official CVE records. All three are Critical, CVSS 4.0 9.4, with vector CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H. Each needs a foothold; none is described as unauthenticated without a prior position. NVD records were in Deferred status when we checked at 13:06 GMT on 11 November 2026 and had not published their own scores. Use the 11 November release posts for the public date; the dates on the werk pages are write dates. The pre-announcement says all editions are affected by the security patch, but werk 22624 and both release posts put Robotmk (CVE-2026-120495) in commercial editions only. We follow the werk.
| CVE | Checkmk werk | What Checkmk describes | Editions |
|---|---|---|---|
| CVE-2026-118965 | Werk 22120 | A malicious remote site can write files on the central site and execute code as the central site user. Checkmk: every setup with potentially untrusted remote sites is affected. | All editions listed on the werk. |
| CVE-2026-120495 | Werk 22624 | Control of a monitored host's agent output can lead to code execution as the site user in Robotmk (Synthetic Monitoring). Checkmk says a host running a Checkmk agent has to be compromised to add crafted agent output, and that 'This usually needs root privileges on a host monitored with Checkmk.' It also needs automatic service discovery, or a monitoring admin confirming Robotmk services. | Commercial editions only (Checkmk Pro, Ultimate, Cloud and Ultimate MT on the werk). We follow the werk here. |
| CVE-2026-121374 | Werk 17994 | A user who can edit rules in at least one folder can get code execution as the site user via the Kubernetes special agent option 'Exclude nodes based on their role'. Checkmk: by default this includes Normal monitoring users with folder permissions, and the site does not need to monitor Kubernetes. Found during Checkmk internal review. | All editions listed on the werk. |
Official CVE weaknesses: CVE-2026-118965 is CWE-22, CVE-2026-120495 is CWE-23, and CVE-2026-121374 is CWE-88. CVE-2026-118965 was reported via Checkmk's security disclosure. CVE-2026-121374 was found during Checkmk internal review. The official CVE records and werks do not name an external researcher for these three issues. Checkmk 2.3.0 is listed as affected and end of life, with no fix. The werk tables also list 3.0.0b1 as not yet released; the available fixes named in the release posts are 2.5.0p19 and 2.4.0p40. Checkmk lists no workaround.
What to Do in the Next 24 Hours
Proactive on the left. Reactive on the right. Vendor steps and our advice are labelled separately.
Upgrade Checkmk
- Checkmk: upgrade 2.5.0 to 2.5.0p19 and 2.4.0 to 2.4.0p40. See the 2.5.0p19 and 2.4.0p40 release posts, and werks 22120, 22624 and 17994. Checkmk lists no workaround.
- Checkmk: move sites on 2.3.0 or older to an actively supported version. 2.3.0 is end of life and will not receive a security patch for these issues.
- Checkmk: before applying this security patch, Checkmk recommends that users update to 2.4.0p39 or 2.5.0p18, to reduce the risk of unrelated breaking changes. That is a recommendation, not a requirement.
- Our advice: inventory every Checkmk site you or your clients run, including central sites, remote sites, lab systems and commercial versus Community editions, and record the exact patch level.
- Our advice: patch central sites first, and until they are patched treat remote sites at client premises as untrusted. That MSP framing is ours, not Checkmk's wording.
- Our advice: remove rule-editing rights from accounts that do not need them, then run the read-only rules.mk checker from the pack.
- Our advice: on commercial editions, do not accept unexpected Robotmk services, and review automatic service discovery.
Hunt and contain
- Our advice: run pack hunts Q2 to Q7b. Those queries are our patterns, not Checkmk indicators. Checkmk has published no indicators of compromise.
- Our advice: review who can edit rules in any folder, including Normal monitoring users, because that is the foothold Checkmk describes for CVE-2026-121374.
- Our advice: on commercial editions that use Robotmk, review automatic service discovery and any recent confirmation of Robotmk services on hosts whose agents you do not fully control.
- Our advice: if anything looks off, take an evidence backup before cleanup, isolate the affected site, apply the fixed build, and rotate site credentials and any credentials the site could reach.
Proactive: Vendor Steps, Then Ours
Checkmk's upgrade first, including the optional recommendation to land on p18 or p39 first, then our advice for inventory and exposure. Our advice is not a substitute for the werks and release posts.
Upgrade to 2.5.0p19 or 2.4.0p40
Checkmk: upgrade affected 2.5.0 to 2.5.0p19, and affected 2.4.0 to 2.4.0p40. Official posts: 2.5.0p19 and 2.4.0p40. Werks: 22120, 22624 and 17994. Downloads are on Checkmk's download page. Checkmk lists no workaround. The werks say no manual configuration change is needed.
Move off 2.3.0 or older
Checkmk: 2.3.0 has reached end of life and will not receive a security patch for these vulnerabilities. If you are still running 2.3.0 or lower, Checkmk strongly recommends upgrading to an actively supported version. The CVE records list 2.3.0 as affected; they do not list older branches as affected. Checkmk's upgrade advice for '2.3.0 or lower' is still the vendor path off unsupported releases.
The p18 or p39 step is a recommendation, not a requirement
In the 6 November pre-announcement, Checkmk wrote: 'Before applying this security patch, we recommend that users update to the current release: 2.4.0p39, or 2.5.0p18. This reduces the risk of unrelated breaking changes that could delay the update.' That is a recommendation, not a requirement.
Patch central sites first
This is our advice, not Checkmk's. Inventory every site, then patch central sites first. Until a central site is patched, treat remote sites at client premises as untrusted. Checkmk says every setup with potentially untrusted remote sites is affected by CVE-2026-118965.
Tighten rule editing, then run the rules.mk checker
Our advice: remove rule-editing rights from accounts that do not need them, including Normal monitoring users where that access is not required, then run the read-only rules.mk checker from the pack. The foothold Checkmk describes for CVE-2026-121374 is a user who can edit rules in at least one folder.
On commercial editions, be careful with Robotmk
Our advice: on commercial editions, do not accept unexpected Robotmk services, and review automatic service discovery. Werk 22624 is listed for commercial editions only. We follow the werk, even though the pre-announcement says all editions are affected by the security patch.
Free Detection Pack
Built by the CybaVerse threat hunt team for businesses, internal IT teams and MSPs. Check exposure offline and hunt for signs of misuse. Everything is read-only.
check-checkmk.sh
Read-only, offline version checker. It compares the Checkmk version you give it, a site version link, or a CSV inventory, against Checkmk's listed ranges. It never contacts Checkmk or a site, and it never runs omd itself. Per-CVE verdicts are included. 2.3.0 is reported VULNERABLE, with an end-of-life note. 2.2.0 and older are OUT OF RANGE, with no claim. Pre-release i or b builds, and daily builds, are UNKNOWN.
bash check-checkmk.sh --version 2.4.0p39.cre --name cmk-01
bash check-checkmk.sh --inventory checkmk-inventory.csvCheck-Checkmk.ps1
The same version checks in PowerShell 7, with identical output and exit codes. It also runs under PowerShell on Linux.
pwsh -File Check-Checkmk.ps1 -Inventory checkmk-inventory.csvcheck-checkmk-kube-rules.sh
Read-only checker (bash and PowerShell 7). It reads rules.mk files and reports Kubernetes node roles that start with a dash. It does not change the site. Our pattern, not Checkmk's.
bash check-checkmk-kube-rules.sh --path /omd/sites/mysite/etc/check_mk/conf.d/watoKQL and Sigma
15 KQL hunts (Q1, Q1b, Q1c and Q1d are inventory; Q2, Q2b, Q3, Q4, Q4b, Q5, Q5b, Q6, Q6b, Q7 and Q7b are our patterns). 6 Sigma rules, all our patterns. These hunts are CybaVerse hunting ideas, not Checkmk guidance and not IOCs. Checkmk has published no indicators of compromise. None of the KQL has been run against a live tenant.
Verdicts
- PATCHED2.5.0p19 or above, or 2.4.0p40 or above.
- VULNERABLE2.5.0 below p19, 2.4.0 below p40, or any 2.3.0 (end of life, no fix).
- OUT OF RANGEA branch Checkmk did not list (for example 2.2.0 or older). No claim either way.
- UNKNOWNPre-release i or b builds, daily builds, no version, or an unreadable version. Never reported as PATCHED.
Each row also gives a per-CVE result: PATCHED, VULNERABLE, NOT AFFECTED (CVE-2026-120495 on Community, per werk 22624) or UNKNOWN.
Exit codes
| Code | Meaning |
|---|---|
| 0 | Every row PATCHED |
| 1 | Any VULNERABLE |
| 2 | Any OUT OF RANGE, none vulnerable |
| 3 | Any UNKNOWN, none vulnerable or out of range |
| 4 | Usage or read error |
Inventory mode exits with the worst row. MSPs can use the exit code in RMM or scheduled jobs.
Know the limits
- The version checkers and the rules.mk checker are read-only and offline. They only read the versions, site path or files you give them, send no network traffic, write nothing, and never contact Checkmk or a device.
- Q2, Q2b, Q3, Q4, Q4b, Q5, Q5b, Q6, Q6b, Q7 and Q7b, and all six Sigma rules, are our own patterns, not Checkmk's. They do not detect the vulnerabilities themselves. Q1, Q1b, Q1c and Q1d are inventory.
- These items are unverified: 2.3.0 edition suffixes; how rules.mk stores the role list on a live site; which parent binaries live under /omd on your build; how Defender names Checkmk packages; Syslog formats for Q7 and Q7b; and whether the Kubernetes agent writes files on a live site.
- None of the KQL has been run against a live tenant.
What is in the pack
| File | What it does |
|---|---|
| check-checkmk.sh | Offline version checker for Linux and macOS (bash), with per-CVE verdicts |
| Check-Checkmk.ps1 | The same version checker in PowerShell 7 |
| check-checkmk-kube-rules.sh / Check-CheckmkKubeRules.ps1 | Read-only rules.mk checker (bash and PowerShell 7) |
| KQL (15 hunts) | Q1, Q1b, Q1c and Q1d inventory; Q2, Q2b, Q3, Q4, Q4b, Q5, Q5b, Q6, Q6b, Q7 and Q7b our patterns |
| Sigma (6 rules) | All our patterns, plus Kusto conversions (in the full pack) |
| tests/ | Fixtures and tests (in the full pack; 36 files in total) |
| README.md | Verified facts, Checkmk's advice versus ours, limits and usage |
Reactive: How to Hunt (Our Advice)
Checkmk has published no indicators of compromise, and says nothing either way about exploitation. The hunts below, and pack queries Q2 to Q7b, are CybaVerse advice, our own patterns. None of the KQL has been run against a live tenant. CybaOps can still run a hunt across your estate.
Inventory and footholds
Confirm every site's patch level against 2.5.0p19 or 2.4.0p40. Note distributed setups with remote sites, accounts that can edit rules in any folder, and commercial sites that use Robotmk with automatic service discovery. Pack queries Q1 to Q1d are inventory.
Run hunts Q2 to Q7b
Run pack queries Q2 to Q7b. They are our patterns, not Checkmk indicators. Look for unexpected files or site-user activity, unexpected Robotmk service additions, and rule changes you cannot tie to a known change window.
Evidence backup before cleanup
If a site looks suspicious, take an evidence backup before cleanup, then review what that site could reach, including other Checkmk sites, monitored hosts and stored credentials.
If you find signs of compromise (our advice)
- Take an evidence backup of the affected Checkmk site before cleanup, and keep its logs.
- Isolate the site from untrusted networks.
- Apply 2.5.0p19 or 2.4.0p40, or move 2.3.0 or older sites onto a supported release that includes the fix.
- Rotate site credentials, automation secrets and any credentials the site could reach.
- Review remote sites, rule changes and Robotmk service additions you cannot account for.
- Start incident response if the site can change monitoring or reach production systems.
Checkmk November 2026 Security Release FAQ
Short answers based on Checkmk werks 22120, 22624 and 17994, the official 11 November 2026 release posts, the 6 November pre-announcement, the official CVE and NVD records, and CISA KEV, checked on 11 November 2026.
What is in the 11 November 2026 Checkmk security release?
Checkmk published 2.5.0p19 at 10:43:37 UTC and 2.4.0p40 at 10:43:49 UTC on 11 November 2026, after pre-announcing the release on 6 November 2026 at 10:54 UTC. The official release posts list three security werks: 22120 (CVE-2026-118965), 22624 (CVE-2026-120495, commercial editions) and 17994 (CVE-2026-121374). The dates on the werk pages (29 October, 2 November and 3 November 2026) are write dates, not the public release date.
How severe are the issues, and does NVD agree?
Checkmk rates all three Critical, CVSS 4.0 9.4, with vector CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H. The official CVE records (CNA: Checkmk) use the same score and vector. The NVD records, which were in Deferred status when we checked on 11 November 2026, show that Checkmk score as Secondary (security@checkmk.com). NVD has not published its own scores. We report Checkmk's 9.4 with that source, and do not invent a second score.
Has Checkmk published IOCs, and are these in CISA KEV?
Checkmk has published no indicators of compromise, and says nothing either way about exploitation. The three CVEs were not in CISA's Known Exploited Vulnerabilities catalogue when we checked at 13:06 GMT on 11 November 2026 (catalogue 2026.11.10, released at 19:03 UTC on 10 November, before this release). That can change; recheck KEV.
Which versions and editions are affected, and is the p18 or p39 step required?
Affected, per the werks and CVE records: Checkmk 2.5.0 before p19, 2.4.0 before p40, and 2.3.0 (end of life, no fix). CVE-2026-118965 and CVE-2026-121374 are listed for all editions on the werks. CVE-2026-120495 (Robotmk) is listed for commercial editions only; we follow the werk, even though the pre-announcement says all editions are affected by the security patch. Checkmk recommends updating to 2.5.0p18 or 2.4.0p39 first, then applying 2.5.0p19 or 2.4.0p40, to reduce the risk of unrelated breaking changes. That is a recommendation, not a requirement. Checkmk lists no workaround. For 2.3.0 or lower, Checkmk recommends moving to a supported version.
What foothold does each vulnerability need?
Each issue requires a foothold; the CVSS vector includes privileges required: low. CVE-2026-118965 needs a malicious or untrusted remote site in a distributed setup. CVE-2026-120495 needs control of a monitored host's agent output, plus automatic service discovery or an admin confirming Robotmk services, and is limited to commercial editions. Checkmk says a host running a Checkmk agent has to be compromised to add crafted agent output, and that this usually needs root privileges on a host monitored with Checkmk. CVE-2026-121374 needs a user who can edit rules in at least one folder, which by default includes Normal monitoring users with folder permissions, and the site does not need to monitor Kubernetes.
Who is this relevant to?
Organisations and MSPs that run Checkmk 2.5.0, 2.4.0 or 2.3.0, especially distributed setups with remote sites, sites where users can edit rules in a folder, and commercial editions that use Robotmk. Our advice, not Checkmk's: patch central sites first, and until then treat remote sites at client premises as untrusted.
Protect Your Checkmk Estate, and Your Customers'
CybaOps monitors your servers, endpoints and cloud workloads, whether that's your own business or your clients'. UK-based analysts monitor alerts 24/7, run these threat hunts and act on pre-approved response actions, and CybaOps drives remediation through to a verified fix, so proactive checks and reactive response happen in one place.
Sources
- Checkmk Forum: stable release 2.5.0p19 (published 11 November 2026, 10:43:37 UTC)
- Checkmk Forum: stable release 2.4.0p40 (published 11 November 2026, 10:43:49 UTC)
- Checkmk Forum: upcoming security release 2.4.0p40 and 2.5.0p19 (published 6 November 2026, 10:54 UTC)
- Checkmk werk 22120: CVE-2026-118965, Code execution through compromised remote site (werk date 29 October 2026)
- Checkmk werk 22624: CVE-2026-120495, Code execution through Robotmk HTML log test service (werk date 2 November 2026)
- Checkmk werk 17994: CVE-2026-121374, Kubernetes special agent excluded node roles (werk date 3 November 2026)
- NVD: CVE-2026-118965 (Deferred; shows Checkmk's CVSS 4.0 9.4; NVD has not scored it itself)
- NVD: CVE-2026-120495 (Deferred; shows Checkmk's CVSS 4.0 9.4; NVD has not scored it itself)
- NVD: CVE-2026-121374 (Deferred; shows Checkmk's CVSS 4.0 9.4; NVD has not scored it itself)
- CISA: Known Exploited Vulnerabilities catalogue (checked 11 November 2026, 13:06 GMT; catalogue 2026.11.10, released 10 November 2026 at 19:03 UTC)