Nagios Host Command Injection Vulnerability Leading to Remote Code Execution

A command injection vulnerability allowing remote code execution has been identified in Nagios Host. This issue arises from improper validation of user-supplied strings in the esensors_websensor_configwizard_func method, enabling authenticated attackers to execute arbitrary code via system calls. The executed code runs under the service account's context.

Impact

Exploitation of this vulnerability allows for arbitrary code execution on the affected system, with the executed code running in the context of the service account.

Remediation

Nagios has released a patch for this vulnerability in the Nagios XI 2026R1.0.1 update. Users are advised to update to this version.