Nagios Core EUVD-2026-57326

The victim must be an authenticated Nagios Core or Nagios XI user with sufficient privileges to execute the targeted command (e.g., administrator or operator role). Active user interaction is required: the victim must follow a malicious link or visit an attacker-controlled page while their Nagios session is active. The core enabling condition is the absence of server-side CSRF token validation - the bypass works against any default Nagios installation using the double-submit cookie mechanism, with no special server-side configuration required beyond a standard install. Exploitation is limited by the mandatory social-engineering step (UI:A), the need for the victim to have an active, authenticated session at the time of the attack, and any network-level controls (firewall rules, VPN requirements) that restrict access to the Nagios web interface. SameSite cookie enforcement at the web server or proxy layer, if already in place, would independently block the cross-origin submission and constitute a hard exploitation barrier.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N) scores 6.1, reflecting that no attacker privileges are needed and complexity is low, but active victim interaction (UI:A) is a hard prerequisite. The absence of any CISA KEV listing and no identified public proof-of-concept code suggests this has not been widely weaponized at time of analysis. The SI:H (high integrity impact on subsequent systems) metric is the dominant risk signal: successful exploitation allows arbitrary Nagios commands to run as the authenticated user, which can disable host/service monitoring, suppress alerting, schedule unauthorized downtime, or trigger active check scripts against monitored infrastructure. The real-world priority is elevated for organizations whose Nagios web interfaces are reachable from the internet or from untrusted internal segments, and where administrators regularly use the interface without strict browser controls. For air-gapped or strictly access-controlled deployments, the practical risk is materially lower. EPSS data was not provided in source intelligence; active exploitation is unconfirmed.

An attacker identifies an organization running an internet-accessible Nagios Core or Nagios XI instance and sends a phishing email to a known Nagios administrator containing a link to a malicious page. The malicious page silently submits a forged HTTP request to the Nagios interface carrying attacker-controlled, pre-matched cookie and CSRF parameter values; because the double-submit validation accepts any matching pair regardless of origin, the CSRF check passes and Nagios executes the embedded command - such as disabling all host notifications - under the administrator's session. No public exploit code has been identified at time of analysis, but the bypass mechanism is straightforward for any attacker familiar with CSRF double-submit cookie weaknesses.