Nagios XI EUVD-2026-115824

Requires an authenticated Nagios XI administrator account with access to the MIB upload feature (mibs.php); the attacker uploads a MIB file whose filename is crafted with tab characters plus a pipe to sh, which evades the install_mib() deny-list that omits semicolons and pipes before the name reaches a grep command run via exec(). Limiting factors: exploitation is gated on high-privilege administrator authentication (PR:H) and on reaching the MIB upload functionality, so it is a post-authentication admin-to-RCE primitive rather than unauthenticated remote code execution; it affects Nagios XI versions before 2026R2 and runs with the privileges of the web server user.

Signals are moderately consistent and point to a genuine but privilege-gated threat rather than a mass-exploitation emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N) and the 8.6 score describe a network-reachable, low-complexity attack with high confidentiality, integrity, and availability impact on the vulnerable system, but it explicitly requires high privileges (PR:H) - the description confirms an authenticated administrator is needed, which sharply narrows the realistic attacker pool to those who already hold admin credentials or can obtain them (e.g., via phishing, credential reuse, or a chained auth-bypass). It is not in CISA KEV, so there is no confirmed active exploitation; no EPSS score was supplied, so exploitation probability cannot be quantified from the input. The vuln.today priority is 'this_week' (not act_now/emergency), and a vendor patch is available, which aligns with a serious-but-schedulable posture. No independent working exploit code is indicated - the VulnCheck entry is an advisory reference, not a confirmed PoC. In short: a real, patchable priority for internet-exposed or multi-admin Nagios XI deployments, but the PR:H requirement means this is post-authentication privilege-to-RCE rather than a pre-auth internet worm; missing EPSS and the absence of KEV listing suggest no evidence of widespread exploitation at time of analysis.

An attacker who has obtained Nagios XI administrator credentials (or an insider admin) navigates to the MIB management feature and uploads a MIB file whose filename is crafted with tab characters and a pipe to sh, bypassing the incomplete deny-list in install_mib(). When the filename is passed into the grep command run via exec(), the injected payload executes arbitrary OS commands as the web server user. No working public exploit is indicated in the input, though VulnCheck has published a technical advisory.