CISA KEV catalog
Confirmed active exploitation.
Listed in CISA's catalog of Known Exploited Vulnerabilities: attackers are using it in real attacks. Patch it with priority.
- Name
- Nagios XI Remote Code Execution Vulnerability
- Added to catalog
- Remediation due date (US federal)
- Required action
- Apply updates per vendor instructions.
Description
Nagios XI before 5.6.6 allows remote command execution as root. The exploit requires access to the server as the nagios user, or access as the admin user via the web interface. The getprofile.sh script, invoked by downloading a system profile (profile.php?cmd=download), is executed as root via a passwordless sudo entry; the script executes check_plugin, which is owned by the nagios user. A user logged into Nagios XI with permissions to modify plugins, or the nagios user on the server, can modify the check_plugin executable and insert malicious commands to execute as root.
Affected products
nagios: nagios xi
References7
- packetstormsecurity.com/files/156676/Nagios-XI-Authenticated-Re… ExploitThird Party AdvisoryVDB Entry
- packetstormsecurity.com/files/162158/Nagios-XI-getprofile.sh-Re… ExploitThird Party AdvisoryVDB Entry
- github.com/jakgibb/nagiosxi-root-rce-exploit ExploitThird Party Advisory
- packetstormsecurity.com/files/156676/Nagios-XI-Authenticated-Re… ExploitThird Party AdvisoryVDB Entry
- packetstormsecurity.com/files/162158/Nagios-XI-getprofile.sh-Re… ExploitThird Party AdvisoryVDB Entry
- github.com/jakgibb/nagiosxi-root-rce-exploit ExploitThird Party Advisory
- www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=… US Government Resource
Metrics
- CVSS 3.1
-
8.8
HIGH
Score source: NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - EPSS — exploit probability
- 77% percentile: 100 · as of 10 November 2026
- CWE
- CWE-78
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.