Vulnerability · Published Oct 30, 2025 · Assigned by VulnCheck

CVE-2025-34286Nagios XI < 2026R1 RCE via Run Check Command in CCM

Critical 9.4

In plain English

A critical-severity OS command injection in XI from Nagios. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.4% (higher than 84% of all known vulnerabilities).

Severity (CVSS 4.0)9.4Critical

Exploit odds (30 days)2.4%top 15.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Nagios XI versions prior to 2026R1 contain a remote code execution vulnerability in the Core Config Manager (CCM) Run Check command. Insufficient validation/escaping of parameters used to build backend command lines allows an authenticated administrator to inject shell metacharacters that are executed on the server. Successful exploitation results in arbitrary command execution with the privileges of the Nagios XI web application user and can be leveraged to gain control of the underlying host operating system.

Affected products (as reported)

Vendor	Product	Versions
Nagios	XI	0 – before 2026R1

Weakness: CWE-78 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

References

https://www.nagios.com/products/security/#nagios-xi vendor-advisory, patch
https://www.nagios.com/changelog/nagios-xi/ release-notes, patch
https://www.vulncheck.com/advisories/nagios-xi-rce-via-run-check-command-in-ccm third-party-advisory