Medium severity · published Oct 16, 2025
CVE-2025-61909
Icinga 2 signals sent as root to processes based on PID file written by the Icinga 2 daemon user
4.4
CVSS
0.2%
EPSS
No
On KEV
Description
Icinga 2 is an open source monitoring system. From 2.10.0 to before 2.15.1, 2.14.7, and 2.13.13, the safe-reload script (also used during systemctl reload icinga2) and logrotate configuration shipped with Icinga 2 read the PID of the main Icinga 2 process from a PID file writable by the daemon user, but send the signal as the root user. This can allow the Icinga user to send signals to processes it would otherwise not permitted to. A fix is included in the following Icinga 2 versions: 2.15.1, 2.14.7, and 2.13.13.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Attack vector
Local
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 12% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IC
icinga2 · Icinga
>=2.10.0, < 2.13.13; >=2.14.0, < 2.14.7; >=2.15.0, < 2.15.1 · source: vendor
IC
Icinga · Icinga
2.10.0 before 2.13.13; 2.14.0 before 2.14.7; 2.15.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-61909
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-61909
Patch
https://github.com/Icinga/icinga2/commit/51ec73cbd922a76fc0f60e1d8d33acd7caa5d587
Issue Tracking
https://github.com/Icinga/icinga2/issues/10527
Patch
https://github.com/Icinga/icinga2/security/advisories/GHSA-pg6g-g99v-mw46
Release Notes
https://icinga.com/blog/releasing-icinga-2-v2-15-1-2-14-7-and-2-13-13-and-icinga-db-web-v1-2-3-and-1-1-4
More from icinga2
9.8
CVE-2026-61550
Icinga 2: Improper access control for JSON-RPC update certificate messages
9.8
CVE-2025-48057
Icinga 2 certificate renewal might incorrectly renew an invalid certificate
9.8
CVE-2024-49369
Icinga 2 has a TLS Certificate Validation Bypass for JSON-RPC and HTTP API Connections
8.6
CVE-2026-61551
Icinga 2: Stack overflow via deeply nested JSON objects
7.2
CVE-2026-61552
Icinga 2 DSL Injection via Unescaped Import Template Name