CVE-2024-13999

CVE-2024-13999 affects Nagios XI versions prior to 2024R1.1.3, where it can disclose the server's Active Directory or LDAP authentication token to an authenticated user under specific conditions. This critical vulnerability, with a CVSS score of 9.8, allows for potential domain-wide authentication misuse, privilege escalation, and compromise of network-integrated systems. The attack vector is network-based with low complexity, requiring no user interaction. While there is no evidence of active exploitation, public exploit code, or KEV listing, the vulnerability has garnered significant community discussion, indicating awareness among security researchers.