Critical severity9.8NVD Advisory· Published Oct 30, 2025· Updated Jun 17, 2026
CVE-2024-13996
CVE-2024-13996
Description
Nagios XI versions prior to 2024R1.1.3 did not invalidate all other active sessions for a user when that user's password was changed. As a result, any pre-existing sessions (including those potentially controlled by an attacker) remained valid after a credential update. This insufficient session expiration could allow continued unauthorized access to user data and actions even after a password change.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
9cpe:2.3:a:nagios:nagios_xi:*:*:*:*:*:*:*:*+ 6 more
- cpe:2.3:a:nagios:nagios_xi:*:*:*:*:*:*:*:*range: <2024
- cpe:2.3:a:nagios:nagios_xi:2024:r1:*:*:*:*:*:*
- cpe:2.3:a:nagios:nagios_xi:2024:r1.0.1:*:*:*:*:*:*
- cpe:2.3:a:nagios:nagios_xi:2024:r1.0.2:*:*:*:*:*:*
- cpe:2.3:a:nagios:nagios_xi:2024:r1.1:*:*:*:*:*:*
- cpe:2.3:a:nagios:nagios_xi:2024:r1.1.1:*:*:*:*:*:*
- cpe:2.3:a:nagios:nagios_xi:2024:r1.1.2:*:*:*:*:*:*
- Nagios/XIv5Range: 0
Patches
Vulnerability mechanics
References
3- www.nagios.com/products/security/nvdVendor Advisory
- www.vulncheck.com/advisories/nagios-xi-session-not-invalidated-after-password-changenvdThird Party Advisory
- www.nagios.com/changelog/nagios-xi/nvdRelease Notes
News mentions
0No linked articles in our index yet.