A command injection flaw in the Nagios Host monitoring wizard allows an authenticated attacker to execute arbitrary commands on the affected service account, potentially bypassing all other security controls. The vulnerability stems from insufficient validation of a user‑supplied string that is passed directly to a system call, classifying it as a CWE‑78 type flaw. Successful exploitation results in full compromise of the host running the Nagios service, with no indication of a limited scope of impact beyond the machine context.

The issue is present in Nagios Host monitoring wizard components used by Nagios XI 2026r1‑0‑1. Any Nagios XI installation running this version prior to the published fix in the 2026r1 series is affected. Users of later patches, such as 2026r1‑0‑2 and beyond, are not impacted.

The vulnerability carries a CVSS score of 8.8, placing it in the high severity range, and an EPSS score of about 2 %, indicating that exploitation is possible but not widespread. It is not listed in the CISA KEV catalog. Authentication is required, so an attacker must first gain valid credentials or otherwise be able to submit authenticated requests to the monitoring wizard interface. The likely attack vector is a remote network request to the Nagios web interface, where the injection is triggered via a crafted parameter. Given these factors, the risk is significant for unpatched systems that are accessible to potential attackers.