Vulnerability in Nagios Enterprises, LLC Nagios XI

[ Description ]Official description

Nagios XI before 2026R2 contains an OS command injection vulnerability in the MIB upload feature where the install_mib() function in mibs.php sanitizes uploaded filenames with an incomplete character-substitution filter that omits semicolons, pipes, and non-space IFS whitespace characters before passing them to a grep command run via exec(). An authenticated administrator can upload a MIB file with a crafted filename using tab characters to bypass the deny-list and pipe to sh via a multipart POST request to mibs.php, resulting in arbitrary OS command execution as the web server user.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ Advisories ]Government CERT advisories

• BSI CERT-Bund3 Nov 2026WID-SEC-2026-4323

  Nagios Enterprises Nagios XI: Vulnerability allows arbitrary code execution with user rights Translated from German

  Risk mediumCVE-2026-119742

[ References ]References

• www.nagios.com/security-disclosures/nagios-xi/2026r2
• www.vulncheck.com/advisories/nagios-xi-2026r2-os-command-injection-via-mibs-php