CVE-2025-34227

Nagios XI < 2026R1 is vulnerable to an authenticated command injection vulnerability within the MongoDB Database, MySQL Query, MySQL Server, Postgres Server, and Postgres Query wizards. It is possible to inject shell characters into arguments provided to the service and execute arbitrary system commands on the underlying host as the `nagios` user.

CVSS 4.0

8.6CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CVSS 3.1

8.8CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

25% chance of exploitation in the next 30 days; higher than 97% of CVEs (scores of 2026-10-25)

CWE

CWE-78

Published

2025-09-25

Modified

2026-10-11

Record from

the NVD, synced 2026-10-19

Affected

• nagios:nagios_xi

References

• https://theyhack.me/CVE-2025-34227-Nagios-XI-Wizard-Command-Injection/
• https://www.nagios.com/changelog/
• https://www.nagios.com/products/security/
• https://www.vulncheck.com/advisories/nagios-xi-config-wizard-auth-command-injection

Check your stackJSON