Nagios XI CVE-2025-34286

Requires an authenticated Nagios XI administrator account with access to the Core Config Manager (CCM) and the ability to invoke the Run Check command; exploitation works against affected versions prior to 2026R1 by injecting shell metacharacters into parameters that are insufficiently validated/escaped before being used to build backend command lines. The primary limiting factor is the administrator privilege level (CVSS PR:H) - this is not an unauthenticated flaw, so exploitation is gated by holding or obtaining Nagios XI admin credentials. No user interaction by a victim is required, and no non-default feature toggle is indicated; the CCM Run Check functionality is core administrative functionality.

This is a genuinely high-severity flaw but with a meaningful access barrier that tempers real-world urgency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N) and the description agree cleanly: network-reachable, low-complexity, no user interaction, but requiring PR:H - an already-authenticated Nagios XI administrator. The impact ceiling is maximal: arbitrary command execution as the web application user with demonstrated escalation to host OS control, reflected in VC:H/VI:H/VA:H and the subsequent-system SC:H/SI:H/SA:H. Exploitation status is 'no public exploit identified at time of analysis' - the input provides no KEV listing, no EPSS score, and no POC flag, so widespread or automated exploitation cannot be asserted. The dominant risk signal is therefore a post-authentication privilege-to-RCE pivot: an attacker who already holds (or phishes/steals) admin credentials, or a malicious/compromised administrator, converts limited web-app admin rights into full host compromise. EPSS and KEV data are MISSING rather than low, so exploitation probability cannot be quantified from the input - do not read their absence as evidence of low likelihood. Net priority: high for internet-exposed or multi-tenant Nagios XI instances where admin access is not fully trusted; moderate where the CCM is tightly restricted to a small set of trusted operators.

An authenticated Nagios XI administrator (or an attacker who has obtained admin credentials via phishing or reuse) opens the Core Config Manager and submits a Run Check command containing shell metacharacters in an insufficiently escaped parameter. The injected payload executes on the server as the Nagios XI web application user, which can then be leveraged to take over the underlying host. No public exploit code is identified in the provided data, but the low attack complexity makes reliable exploitation straightforward once admin access exists.