CVE-2025-34227

high · 8.6

Nagios XI < 2026R1 is vulnerable to an authenticated command injection vulnerability within the MongoDB Database, MySQL Query, MySQL Server, Postgres Server, and Postgres Query wizards. It is possible to inject shell characters into arguments provided to the service and execute arbitrary system commands on the underlying host as the `nagios` user.

8.6

CVSS

24.3%

EPSS (exploit prob.)

98th

EPSS percentile

2025-09-25

Published

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weaknesses

CWE-78

Affected products

Vendor	Product	Affected versions
nagios	nagios_xi	<= 2026

Check a specific version with /api/v1/cve/match.

References

https://theyhack.me/CVE-2025-34227-Nagios-XI-Wizard-Command-Injection/
https://www.nagios.com/changelog/
https://www.nagios.com/products/security/
https://www.vulncheck.com/advisories/nagios-xi-config-wizard-auth-command-injection

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2025-34227