This vulnerability arises from the lack of input validation in the zabbixagent_configwizard_func method, allowing a malicious user to supply a string that is passed directly to a system call. The resulting command injection gives an authenticated attacker the ability to run arbitrary code with the privileges of the Nagios service account, potentially compromising confidentiality, integrity, and availability of the host.

The flaw affects Nagios Host, specifically the Nagios XI 2026 release 1 family (e.g., version 2026r1-0-1). All installations that include the zabbixagent_configwizard_func routine are impacted and authentication to the application is required to invoke the vulnerable function.

The CVSS score of 8.8 describes a high severity vulnerability, and the EPSS score of 76% indicates a significant risk of active exploitation. While the exploitation requires authenticated access, the channel used was not detailed in the advisory, so it is inferred that the attacker would need to submit a crafted parameter via an authenticated request to the function. The vulnerability is not listed in the CISA KEV catalog. An attacker who gains the ability to inject commands can execute code as the Nagios service account, potentially enabling full system compromise.