The vulnerability is a command injection flaw in the esensors_websensor_configwizard_func function of Nagios XI 2026 r1. Because the function fails to sanitize user‑supplied strings before executing a system call, an attacker who authenticates to the service can inject arbitrary shell commands. The impact is the execution of arbitrary code in the context of the service account, enabling full compromise of the host.

Affected systems are installations of Nagios XI version 2026 r1, commonly deployed as Nagios Host. The issue is present in that release and no other versions are cited, so only this specific release is known to be vulnerable.

The CVSS score of 8.8 indicates high severity, and an EPSS score of 1% suggests a low but non‑zero likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, implying no confirmed exploits yet. Authentication is required, so attackers need valid credentials or compromised accounts to leverage the flaw, likely via legitimate administrative access. Once authenticated, they can run arbitrary commands with the privileges of the Nagios service account.