CVE-2024-13996 is a critical (CVSS 9.8) insufficient session expiration flaw in Nagios XI versions before 2024R1.1.3. Changing a user's password did not end that user's other active sessions, so a stolen session kept working. Upgrade to 2024R1.1.3 or later and treat past password resets as incomplete.
What's affected
Nagios XI versions prior to 2024R1.1.3 are affected. The fix is in 2024R1.1.3 or any later release.
The description says that when a user's password was changed, all other active sessions for that user were not invalidated. Any existing session, including one controlled by an attacker, stayed valid after the credential update.
The VulnCheck advisory credits the report to Jack Eli. The Nagios changelog is the place to confirm which release you should move to.
How to check if you're exposed
Nagios XI shows its version in the web interface after login, and on a default Linux install the version file can be read from the shell:
grep full /usr/local/nagiosxi/var/xiversion
If the output shows a release older than the fixed version above, treat the server as affected. If the path differs on your install, use the version shown in the Nagios XI web interface or follow the steps in the vendor changelog.
What to do now
- Upgrade Nagios XI to 2024R1.1.3 or later.
- After the upgrade, force every user to sign in again so that any old session is gone.
- If you reset a password because of suspected compromise on an older release, repeat the reset after the upgrade. The earlier reset may not have ended the attacker's session.
- Review recent logins for unfamiliar source addresses or times.
- Restrict the web interface to management networks and require a VPN.
Why it matters
The class is CWE-613, insufficient session expiration. A password reset is the standard response when an account may be taken over. If the server keeps honouring the old session, the reset gives a false sense of safety, and the attacker keeps acting as the user.
The attacker still needs a valid session to begin with, for example from a stolen cookie. That makes this a persistence problem more than an entry problem, but the CVSS 9.8 base score reflects the broad access a monitoring administrator account holds. Ending all sessions on credential change is a small code change with a large effect on incident response.
Quick check
Is a password reset enough to lock out an attacker on an affected version?
Not on versions before 2024R1.1.3. Old sessions stayed valid. Upgrade, then reset again and make everyone sign in fresh.
Sources
Last reviewed: 19 October 2026.
