A command injection flaw resides in the monitoringwizard module of Nagios Host. The vulnerability is caused by sending a user‑supplied string directly to a system call without proper validation, classifying it as a CWE‑78 issue. An attacker who can authenticate to the Nagios web interface can send a crafted request that executes arbitrary commands in the context of the Nagios service account, enabling complete control over the host.

The flaw appears in Nagios XI installations that include the monitoringwizard component, specifically the 2026r1 series. Any instance of Nagios XI 2026r1 running this module and not yet updated with a patch that removes the vulnerable code is affected. Versions outside that series are not known to be impacted by this specific issue, but no confirmatory data are available for other versions.

The CVSS score of 8.8 places this vulnerability in the high severity bracket, and the EPSS score of 6% indicates a moderate likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Authentication is required, so the attacker must first acquire valid credentials or otherwise be able to submit authenticated requests to the monitoringwizard interface. The likely attack vector is a remote network request to the Nagios web interface where the injection is triggered via a crafted parameter. Given these factors, unpatched systems remain at significant risk if exposed to adversaries.