Nagios Host Monitoringwizard Command Injection Remote Code Execution Vulnerability

A command injection vulnerability allowing remote code execution has been identified in the Nagios Host monitoringwizard module. This issue arises from inadequate validation of user-supplied input, which can be exploited to execute arbitrary code via system calls. The executed code runs under the service account's context. Authentication is required to exploit this vulnerability.

Impact

Exploitation of this vulnerability allows for arbitrary code execution on the affected system, with the executed code running in the context of the service account.

Remediation

Nagios has released a patch for this vulnerability in the version 2026R1.0.1. Users are advised to update to this version.