TL;DR Icinga patched three Icinga 2 vulnerabilities on 29 June 2026. Two let an unauthenticated attacker take over or crash the monitoring server. The third affects authenticated API users only. CVE numbers are still pending. No exploitation in the wild has been confirmed. Why It Matters Icinga 2 monitors large networks across many sites. So a compromised instance exposes broad infrastructure detail.