TI-2026-84257 Aliases CVE-2026-119742 GHSA-xgjr-r6p2-hvm3

OS command injection in Nagios XI via MIB upload

MEDIUM 46CWE-78Published 2026-11-03 · Updated 2026-11-03

Key facts

Attack vector: Network
Privileges required: High
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-78.

Summary

Nagios XI before 2026R2 contains an OS command injection flaw in the MIB upload feature, where the install_mib() function in mibs.php filters uploaded filenames incompletely before passing them to a grep command run via exec(). An authenticated administrator can upload a MIB file with a crafted filename to run arbitrary OS commands as the web server user, CWE-78.

Written with Claude Haiku 5.5 from the sources below · 2026-11-03

Description from the CNA

Nagios XI before 2026R2 contains an OS command injection vulnerability in the MIB upload feature where the install_mib() function in mibs.php sanitizes uploaded filenames with an incomplete character-substitution filter that omits semicolons, pipes, and non-space IFS whitespace characters before passing them to a grep command run via exec(). An authenticated administrator can upload a MIB file with a crafted filename using tab characters to bypass the deny-list and pipe to sh via a multipart POST request to mibs.php, resulting in arbitrary OS command execution as the web server user.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.04088 90th percentileScored 2026-11-07

Fix Fixed Nagios XI (Nagios Enterprises, LLC): 2026R2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Nagios Enterprises, LLC.	Nagios XI	before 2026R2	2026R2	Patch available	CNA

Nagios XI VendorNagios Enterprises, LLC. Affected before 2026R2 Fixed in 2026R2 Patch available CNA

Remediation

Upgrade Nagios XI to version 2026R2 or later, which fixes this issue.

Written with Claude Haiku 5.5 from the sources below · 2026-11-03

Fix · CNA Nagios XI (Nagios Enterprises, LLC) Fixed in 2026R2

Timeline

2026-11-03 Threatist record created from CVE-2026-119742
2026-11-03 CISA SSVC decision points changed
2026-11-03 Priority changed: MEDIUM → LOW
2026-11-03 Alias added: GHSA-xgjr-r6p2-hvm3
2026-11-05 Priority changed: LOW → MEDIUM

References

Patch 1

Release Notes

TI-2012-05452 Nagios XI Network Monitor Graph Explorer Component < 1.3 Authenticated Command Injection CVSS 4.0HIGH 8.6
TI-2026-35913 Nagios Core / XI Authenticated RCE via Unfiltered NOTIFICATION-Family Macro Substitution CVSS 4.0HIGH 7.7
TI-2026-35912 Nagios Core / XI Authenticated RCE via Custom-Variable Macro Injection CVSS 4.0HIGH 7.7
TI-2026-35908 Nagios Core / XI CSRF via cmd.cgi Double-Submit Cookie CVSS 4.0MEDIUM 6.9
TI-2026-35907 Nagios Core CSRF via cmd.cgi CVSS 4.0MEDIUM 6.9
TI-2026-35910 Nagios Core / XI CSRF Protection Bypass via Double-Submit Cookie CVSS 4.0MEDIUM 6.1

See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences