Which versions of Nagios Core are affected by EUVD-2026-57346?

Nagios Core and Nagios XI contain a remote code execution vulnerability affecting authenticated administrative users with custom notification command configurations, potentially allowing insider…. A patch is available.

How to fix or mitigate EUVD-2026-57346?

Within 24 hours, identify all Nagios Core (versions before 4.5.14) and Nagios XI (versions before 2026R1.7) installations and restrict UI access to essential administrators only; disable any non-standard notification commands. Within 7 days, apply vendor patches: upgrade Nagios Core to 4.5.14 or later and Nagios XI to 2026R1.7 or later across all instances. Within 30 days, audit all notification command configurations to identify and remove any shell-executed commands using $NOTIFICATIONCOMMENT$ or $NOTIFICATIONAUTHOR$ macros, and enforce least-privilege permissions on the nagios system account.

Nagios Core EUVD-2026-57346

Q: What is the CVSS score of EUVD-2026-57346?

EUVD-2026-57346 has a CVSS 4.0 base score of 7.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.5%.

| CVE-2026-48554 HIGH

OS Command Injection (CWE-78)

2026-08-12 VulnCheck

GHSA-f3vr-3658-6fxw

RCE Command Injection Nagios Xi Nagios Core Nagios Enterprises Llc

7.7

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

7.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.5 HIGH

Non-default shell-macro configuration maps to AC:H in 3.1; PR:L for required authenticated UI access; S:U since execution stays within the nagios user context without escaping system boundaries.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

7.5 HIGH

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Aug 12, 2026 - 17:38 vuln.today

CVE Published

Aug 12, 2026 - 16:48 cve.org

HIGH 7.7

DescriptionCVE.org

Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 are vulnerable to authenticated remote code execution via unfiltered NOTIFICATION-family macro substitution through the com_data parameter. When a notification command references $NOTIFICATIONCOMMENT$ or $NOTIFICATIONAUTHOR$ in a shell-reachable position, authenticated UI users can run arbitrary commands as the nagios user. Exploitation requires a non-default configuration in which a notification command references these macros in a shell-executed command line.

AnalysisAI

Remote code execution in Nagios Core (before 4.5.14) and Nagios XI (before 2026R1.7) allows authenticated UI users to run arbitrary OS commands as the nagios system user by injecting shell metacharacters through the com_data parameter when notification commands reference $NOTIFICATIONCOMMENT$ or $NOTIFICATIONAUTHOR$ macros in shell-executed positions. The vulnerability is classified as CWE-78 (OS Command Injection) and reported by VulnCheck; vendor-released patches are now available for both product lines. No public exploit identified at time of analysis, and exploitation is bounded by a non-default notification command configuration requirement reflected in the CVSS 4.0 AT:P metric.

Technical ContextAI

The root cause is CWE-78 (OS Command Injection): Nagios's notification subsystem performs macro substitution - replacing tokens like $NOTIFICATIONCOMMENT$ (user-supplied acknowledgment text) and $NOTIFICATIONAUTHOR$ (submitting username) into notification command strings before executing them via a shell interpreter. When an administrator configures a notification command that embeds these macros directly in a shell-executed command line (e.g., /bin/sh -c 'notify.sh "$NOTIFICATIONCOMMENT$"'), any user-controlled value in the macro position bypasses shell escaping, allowing injection of arbitrary shell metacharacters. The injection surface is the com_data POST parameter accepted by the Nagios UI. Affected products per CPE data: Nagios Core (cpe:2.3:a:nagios_enterprises,_llc.:nagios_core:*) all versions before 4.5.14, and Nagios XI (cpe:2.3:a:nagios_enterprises,_llc.:nagios_xi:*) all versions before 2026R1.7, both by Nagios Enterprises, LLC.

RemediationAI

Upgrade Nagios Core to version 4.5.14 or later and Nagios XI to version 2026R1.7 or later; the vendor advisory is at https://www.nagios.com/security-disclosures/nagios-core/ and the Nagios Core Changelog tracking the fix is at https://github.com/NagiosEnterprises/nagioscore/blob/master/Changelog. For organizations unable to patch immediately, audit all notification command definitions in nagios.cfg and associated configuration files and identify any commands that pass $NOTIFICATIONCOMMENT$ or $NOTIFICATIONAUTHOR$ directly into a shell-interpreted command line - remove these macro references from shell-executed positions or replace them with safer argument-passing patterns (e.g., exporting the value as an environment variable consumed by the script rather than interpolating it inline). Be aware that removing these macros from notification commands will suppress the corresponding dynamic content in alert messages and must be validated against operational alerting workflows before deployment. Additionally, restrict Nagios UI access to the minimum necessary set of trusted operators, reducing the authenticated attacker pool in the interim.