VDB
CVE-2025-34286
CVE-2025-34286
PUBLISHED
CVSS 9.399999618530273 CRITICAL
Nagios XI versions prior to 2026R1 contain a remote code execution vulnerability in the Core Config Manager (CCM) Run Check command. Insufficient validation/escaping of parameters used to build backend command lines allows an authenticated administrator to inject shell metacharacters that are executed on the server. Successful exploitation results in arbitrary command execution with the privileges of the Nagios XI web application user and can be leveraged to gain control of the underlying host operating system.
EPSS 1.35% · 80.5th percentile
Risk Scores
CVSS 4.0
9.399999618530273
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
EPSS Score
1.35%
80.5th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Nagios | XI | 0 |
| nagios | nagios_xi | 0, 0 |
Timeline
- Oct 30, 2025 CVE Published
- Oct 31, 2025 EPSS Score
- Oct 31, 2025 PoC Published
- Nov 6, 2025 EPSS Score
- Nov 11, 2025 EPSS Score
- Nov 17, 2025 EPSS Score
- Nov 22, 2025 EPSS Score
- Nov 28, 2025 EPSS Score
- Dec 3, 2025 EPSS Score
- Dec 9, 2025 EPSS Score
- Dec 14, 2025 EPSS Score
- Dec 20, 2025 EPSS Score
References
- https://www.nagios.com/products/security/#nagios-xi vendor-advisory
- https://www.nagios.com/changelog/nagios-xi/ patch
- https://www.vulncheck.com/advisories/nagios-xi-rce-via-run-check-command-in-ccm third-party-advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-34286 advisory
- https://www.nagios.com/changelog/nagios-xi url