A command‑injection flaw exists in the zabbixagent_configwizard_func method of Nagios XI. User supplied data is not validated before being passed to a system call, allowing an authenticated attacker to run arbitrary commands with the privileges of the Nagios service account. This directly compromises confidentiality, integrity and availability of the affected system.

The vulnerability affects Nagios Host, specifically the Nagios XI 2026 release 1 family (for example version 2026r1-0-1). All installations of this product that include the zabbixagent_configwizard_func routine and do not apply a vendor patch are vulnerable.

With a CVSS score of 8.8 the flaw is measured as high severity; an exploitation probability of 2% indicates a realistic likelihood of being leveraged. The vulnerability is not yet listed in the CISA Known Exploited Vulnerabilities catalog. An attacker must first authenticate to the application and then invoke the vulnerable function, based on the description it is inferred that the attacker might use the web interface or API to launch arbitrary code. Successful exploitation would give the attacker full control over the Nagios process environment.