Actively exploited in the wild

Nagios XI OS Command Injection

Nagios - Nagios XI · Listed in the CISA KEV since 2022-01-18. This indicates confirmed attacks in production environments.

Required action: Apply updates per vendor instructions.

CVE-2021-25296

HighCVSS 8.8KEV

Published: 15/02/2021(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Very high risk

71.54%

99th percentile - higher than 99% of all known CVEs

Summary

Nagios XI version xi-5.7.5 is affected by OS command injection in the file windowswmi.inc.php due to improper sanitization of authenticated user input. This allows execution of arbitrary commands on the server.

Risk Assessment

An authenticated attacker can execute arbitrary OS commands on the Nagios XI server, leading to full system compromise and potential control over monitored infrastructure.

Recommendation

Upgrade Nagios XI to the latest patched version immediately. Additionally, restrict administrative interface access to trusted IP addresses only.

Original NVD description (English source)

Nagios XI version xi-5.7.5 is affected by OS command injection. The vulnerability exists in the file /usr/local/nagiosxi/html/includes/configwizards/windowswmi/windowswmi.inc.php due to improper sanitization of authenticated user-controlled input by a single HTTP request, which can lead to OS command injection on the Nagios XI server.