High severity · published Sep 25, 2025
CVE-2025-34227
Nagios XI < 2026R1 Configuration Wizard Authenticated Command Injection
8.8
CVSS
25.4%
EPSS
No
On KEV
Description
Nagios XI < 2026R1 is vulnerable to an authenticated command injection vulnerability within the MongoDB Database, MySQL Query, MySQL Server, Postgres Server, and Postgres Query wizards. It is possible to inject shell characters into arguments provided to the service and execute arbitrary system commands on the underlying host as the `nagios` user.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)25.4% · higher than 98% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NX
Nagios XI · Nagios
before 2026R1 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-34227
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-34227
Exploit
https://theyhack.me/CVE-2025-34227-Nagios-XI-Wizard-Command-Injection/
Release Notes
https://www.nagios.com/changelog/
Vendor Advisory
https://www.nagios.com/products/security/
Third Party Advisory
https://www.vulncheck.com/advisories/nagios-xi-config-wizard-auth-command-injection
More from Nagios XI
8.8
CVE-2021-25297
Nagios XI OS Command Injection
8.8
CVE-2021-25298
Nagios XI OS Command Injection
8.8
CVE-2021-25296
Nagios XI OS Command Injection
8.8
CVE-2019-15949
Nagios XI Remote Code Execution Vulnerability
9.8
CVE-2024-13996
Nagios XI < 2024R1.1.3 Session Not Invalidated After Password Change