CVE-2025-34286
Published: 30 October 2025
Summary
CVE-2025-34286 is a critical-severity OS Command Injection (CWE-78) vulnerability in Nagios Nagios Xi. Its CVSS base score is 9.4 (Critical).
Operationally, ranked in the top 19.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
Nagios XI versions prior to 2026R1 are affected by a remote code execution vulnerability in the Core Config Manager (CCM) Run Check command. The flaw stems from insufficient validation and escaping of parameters used to construct backend command lines, corresponding to CWE-78, and carries a CVSS 4.0 score of 9.4 reflecting high impact across confidentiality, integrity, and availability both locally and in scope.
An authenticated administrator can exploit the issue by injecting shell metacharacters into the Run Check parameters. Successful exploitation yields arbitrary command execution under the privileges of the Nagios XI web application user, which can be escalated to full control of the underlying host operating system.
Advisories from Nagios and VulnCheck indicate that the issue is resolved in Nagios XI 2026R1; organizations should apply the update from the vendor changelog and security pages. The associated EPSS score remains low and unchanged at 0.0135 with no observed rise after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-37209
Vulnerability details
Nagios XI versions prior to 2026R1 contain a remote code execution vulnerability in the Core Config Manager (CCM) Run Check command. Insufficient validation/escaping of parameters used to build backend command lines allows an authenticated administrator to inject shell metacharacters that…
more
are executed on the server. Successful exploitation results in arbitrary command execution with the privileges of the Nagios XI web application user and can be leveraged to gain control of the underlying host operating system.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.