Vulnerability · Published Nov 3, 2026 · Assigned by VulnCheck

CVE-2026-119742Nagios XI < 2026R2 OS Command Injection via mibs.php

High 7.2

In plain English

A high-severity OS command injection in Nagios XI from Nagios Enterprises, LLC. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 4.1% (higher than 91% of all known vulnerabilities).

Severity (CVSS 3.1)7.2High

Exploit odds (30 days)4.1%top 9.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Nagios XI before 2026R2 contains an OS command injection vulnerability in the MIB upload feature where the install_mib() function in mibs.php sanitizes uploaded filenames with an incomplete character-substitution filter that omits semicolons, pipes, and non-space IFS whitespace characters before passing them to a grep command run via exec(). An authenticated administrator can upload a MIB file with a crafted filename using tab characters to bypass the deny-list and pipe to sh via a multipart POST request to mibs.php, resulting in arbitrary OS command execution as the web server user.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Ubuntu:22.04:LTS	nagios4	no fix listed	UBUNTU-CVE-2026-119742
Ubuntu:24.04:LTS	nagios4	no fix listed	UBUNTU-CVE-2026-119742
Ubuntu:26.04:LTS	nagios4	no fix listed	UBUNTU-CVE-2026-119742
Ubuntu:26.10	nagios4	no fix listed	UBUNTU-CVE-2026-119742

Affected products (as reported)

Vendor	Product	Versions
Nagios Enterprises, LLC	Nagios XI	0 – before 2026R2

Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

References

Release Notes release-notes, patch
VulnCheck Advisory: Nagios XI < 2026R2 OS Command Injection via mibs.php third-party-advisory