CVE-2025-34227High· 8.8▾ MidnightPoC availableNagios XI < 2026R1 is vulnerable to an authenticated command injection vulnerability within the MongoDB Database, MySQL Query, MySQL Server, Postgres Server, and Postgres Query wizards. It is possible to inject shell characters into argu…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 48.4 · likelihood 4.9 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
24%
1 GitHub repo (last check)
Nagios XI < 2026R1 is vulnerable to an authenticated command injection vulnerability within the MongoDB Database, MySQL Query, MySQL Server, Postgres Server, and Postgres Query wizards. It is possible to inject shell characters into arguments provided to the service and execute arbitrary system commands on the underlying host as the nagios user.
nagios_xi <= 2026Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2021-25298High· 8.8Nagios XI version xi-5.7.5 is affected by OS command injection
CVE-2021-25297High· 8.8Nagios XI version xi-5.7.5 is affected by OS command injection
CVE-2025-34286High· 7.2Nagios XI versions prior to 2026R1 contain a remote code execution vulnerability in the Core Config Manager (CCM) Run Check command
CVE-2024-14003Critical· 9.8Nagios XI versions prior to 2024R1.2 are vulnerable to remote code execution (RCE) through its NRDP (Nagios Remote Data Processor) server plugins
CVE-2024-14005High· 8.8Nagios XI versions prior to 2024R1.2 contain a command injection vulnerability in the Docker Wizard
CVE-2024-14008High· 7.2Nagios XI versions prior to 2024R1.3.2 contain a remote command execution vulnerability in the WinRM Configuration Wizard