EUVD-2026-57346
GHSA-f3vr-3658-6fxw
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Non-default shell-macro configuration maps to AC:H in 3.1; PR:L for required authenticated UI access; S:U since execution stays within the nagios user context without escaping system boundaries.
AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 are vulnerable to authenticated remote code execution via unfiltered NOTIFICATION-family macro substitution through the com_data parameter. When a notification command references $NOTIFICATIONCOMMENT$ or $NOTIFICATIONAUTHOR$ in a shell-reachable position, authenticated UI users can run arbitrary commands as the nagios user. Exploitation requires a non-default configuration in which a notification command references these macros in a shell-executed command line.
AnalysisAI
Remote code execution in Nagios Core (before 4.5.14) and Nagios XI (before 2026R1.7) allows authenticated UI users to run arbitrary OS commands as the nagios system user by injecting shell metacharacters through the com_data parameter when notification commands reference $NOTIFICATIONCOMMENT$ or $NOTIFICATIONAUTHOR$ macros in shell-executed positions. The vulnerability is classified as CWE-78 (OS Command Injection) and reported by VulnCheck; vendor-released patches are now available for both product lines. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires two conditions to be simultaneously true: first, the attacker must hold valid Nagios UI credentials with sufficient permissions to submit acknowledgment comments or otherwise populate the $NOTIFICATIONCOMMENT$ or $NOTIFICATIONAUTHOR$ macros through the com_data POST parameter - unauthenticated network attackers are excluded; second, at least one active notification command in the Nagios configuration must reference $NOTIFICATIONCOMMENT$ or $NOTIFICATIONAUTHOR$ in a position where the resulting string is passed to a shell interpreter (e.g., via /bin/sh -c or a script that eval's its arguments). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H) scores 7.7 and captures the key tension in this vulnerability: individually high-impact metrics are tempered by AT:P (attack requirements present), which encodes the non-default configuration prerequisite that an organization's notification commands must already reference these macros in shell-reachable positions. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Nagios Core to version 4.5.14 or later and Nagios XI to version 2026R1.7 or later; the vendor advisory is at https://www.nagios.com/security-disclosures/nagios-core/ and the Nagios Core Changelog tracking the fix is at https://github.com/NagiosEnterprises/nagioscore/blob/master/Changelog. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Nagios Core (versions before 4.5.14) and Nagios XI (versions before 2026R1.7) installations and restrict UI access to essential administrators only; disable any non-standard notification commands. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Nagios Core
View allqh_core in Nagios Core 4.4.1 and earlier is prone to a NULL pointer dereference vulnerability, which allows attackers to
qh_echo in Nagios Core 4.4.1 and earlier is prone to a NULL pointer dereference vulnerability, which allows attackers to
Nagios Core 4.4.2 has XSS via the alert summary reports of plugin results, as demonstrated by a SCRIPT element delivered
Nagios Core application version 4.2.4 is vulnerable to Site-Wide Cross-Site Request Forgery (CSRF) in many functions, li
Nagios Core through 4.3.4 initially executes /usr/sbin/nagios as root but supports configuration options in which this f
Authenticated remote code execution in Nagios Core (before 4.5.13) and Nagios XI (before 2026R1.5) is achievable via OS
Cross-site request forgery in Nagios Core (before 4.5.13) and Nagios XI (before 2026R1.5) allows an attacker to execute
Cross-site request forgery in Nagios Core before 4.5.12 enables remote attackers to execute arbitrary monitoring command
Cross-site request forgery protection bypass in Nagios Core (before 4.5.14) and Nagios XI (before 2026R1.7) allows unaut
DOM-based cross-site scripting in Nagios Core (before 4.5.14) and Nagios XI (before 2026R1.7) allows an authenticated lo
Reflected cross-site scripting in Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 allows unauthenticated remote
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allVendor StatusVendor
SUSE
Severity: ImportantShare
External POC / Exploit Code
Leaving vuln.today