Read the docs
TI-2025-24425 Aliases CVE-2025-34288GHSA-2488-c4gj-6g77

Nagios XI Privilege Escalation via Writable PHP Include Executed with Sudo

Priority MEDIUM 43CWE-732Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Nagios XI versions prior to 2026R1.1 are vulnerable to local privilege escalation due to an unsafe interaction between sudo permissions and application file permissions. A user‑accessible maintenance script may be executed as root via sudo and includes an application file that is writable by a lower‑privileged user. A local attacker with access to the application account can modify this file to introduce malicious code, which is then executed with elevated privileges when the script is run. Successful exploitation results in arbitrary code execution as the root user.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01853 79th percentileScored 2026-11-07
Fix Fixed Nagios XI (Nagios Enterprises): 2026R1.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Nagios Enterprises, LLC.Nagios XIbefore 2026R1.12026R1.1Patch availableCNA

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:nagios:nagios_xi:*:*:*:*:*:*:*:*up to 2024VulnerableNagios
cpe:2.3:a:nagios:nagios_xi:2026:r1:*:*:*:*:*:*2026 r1VulnerableNagios
cpe:2.3:a:nagios:nagios_xi:2026:r1.0.1:*:*:*:*:*:*2026 r1.0.1VulnerableNagios
  • cpe:2.3:a:nagios:nagios_xi:*:*:*:*:*:*:*:* Versions up to 2024 Vulnerable ·Nagios
  • cpe:2.3:a:nagios:nagios_xi:2026:r1:*:*:*:*:*:* Versions 2026 r1 Vulnerable ·Nagios
  • cpe:2.3:a:nagios:nagios_xi:2026:r1.0.1:*:*:*:*:*:* Versions 2026 r1.0.1 Vulnerable ·Nagios

Remediation

  • Fix · CNA Nagios XI (Nagios Enterprises) Fixed in 2026R1.1

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-34288
  2. 2026-10-03 Alias added: GHSA-2488-c4gj-6g77

References

Patch 1

  • TI-2012-05452 Nagios XI Network Monitor Graph Explorer Component < 1.3 Authenticated Command Injection CVSS 4.0HIGH 8.6
  • TI-2026-84257 OS command injection in Nagios XI via MIB upload CVSS 4.0HIGH 8.6
  • TI-2026-35913 Nagios Core / XI Authenticated RCE via Unfiltered NOTIFICATION-Family Macro Substitution CVSS 4.0HIGH 7.7
  • TI-2026-35912 Nagios Core / XI Authenticated RCE via Custom-Variable Macro Injection CVSS 4.0HIGH 7.7
  • TI-2026-35908 Nagios Core / XI CSRF via cmd.cgi Double-Submit Cookie CVSS 4.0MEDIUM 6.9
  • TI-2026-35907 Nagios Core CSRF via cmd.cgi CVSS 4.0MEDIUM 6.9
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences