The flaw resides in the zabbixagent_configwizard_func method, where unsanitized user input is passed directly to a system call. This allows an authenticated client to inject arbitrary commands, which then execute in the service account context of Nagios Host. Arbitrary code execution can potentially compromise confidentiality, integrity, and availability of the affected system.

The vulnerability affects Nagios Host, specifically the Nagios XI 2026 release 1 family (e.g., version 2026r1-0-1). All installations that include the zabbixagent_configwizard_func routine are impacted, requiring authentication to the application to call the vulnerable function.

With a CVSS score of 8.8, the flaw is considered high severity, and the EPSS score of 73% indicates a high likelihood that the vulnerability may be actively exploited. The vulnerability is not listed in the CISA KEV catalog. An attacker must authenticate to the application and invoke the vulnerable function, likely using the web interface or API. Successful exploitation could allow an attacker to execute arbitrary code as the Nagios service account.