Description
Nagios XI < 2026R1 is vulnerable to an authenticated command injection vulnerability within the MongoDB Database, MySQL Query, MySQL Server, Postgres Server, and Postgres Query wizards. It is possible to inject shell characters into arguments provided to the service and execute arbitrary system commands on the underlying host as the `nagios` user.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Nagios | Nagios XI | < 2026R1 | 2026R1 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
GitHub 1 repository
-
Simple proof of concept repository for CVE-2025-34227 Nagios XI authenticated command injection in Configuration Wizard
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 1
- WID-SEC-2025-2133 Nagios Enterprises Nagios XI: Schwachstelle ermöglicht Ausführen von beliebigem Programmcode BSI CERT-Bund (WID) · Sep 25, 2025
References
- https://www.nagios.com/changelog/ vendor-advisory patch
- https://www.nagios.com/products/security/ vendor-advisory patch
- https://www.vulncheck.com/advisories/nagios-xi-config-wizard-auth-command-injection third-party-advisory
- https://theyhack.me/CVE-2025-34227-Nagios-XI-Wizard-Command-Injection/ technical-description exploit