Vulnerability · Published Sep 25, 2025 · Assigned by VulnCheck

CVE-2025-34227Nagios XI < 2026R1 Configuration Wizard Authenticated Command Injection

High 8.6

In plain English

A high-severity OS command injection in Nagios XI from Nagios. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 26.5% (higher than 98% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.

Severity (CVSS 4.0)8.6High

Exploit odds (30 days)26.5%top 2.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling1Public PoC

Official description

Nagios XI < 2026R1 is vulnerable to an authenticated command injection vulnerability within the MongoDB Database, MySQL Query, MySQL Server, Postgres Server, and Postgres Query wizards. It is possible to inject shell characters into arguments provided to the service and execute arbitrary system commands on the underlying host as the `nagios` user.

Affected products (as reported)

Vendor	Product	Versions
Nagios	Nagios XI	0 – before 2026R1

Weakness: CWE-78 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

https://www.nagios.com/changelog/ vendor-advisory, patch
https://www.nagios.com/products/security/ vendor-advisory, patch
https://www.vulncheck.com/advisories/nagios-xi-config-wizard-auth-command-injection third-party-advisory
https://theyhack.me/CVE-2025-34227-Nagios-XI-Wizard-Command-Injection/ technical-description, exploit