Nagios vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Exploited Nagios flaws

These are on CISA’s Known Exploited Vulnerabilities list, newest first. If you run any of these products, these come before everything else.

• CVE-2021-25298 Nagios XI OS Command InjectionExploited since Jan 18, 2022 · CVSS 8.8
• CVE-2021-25297 Nagios XI OS Command InjectionExploited since Jan 18, 2022 · CVSS 8.8
• CVE-2021-25296 Nagios XI OS Command InjectionExploited since Jan 18, 2022 · CVSS 8.8
• CVE-2019-15949 Nagios XI Remote Code ExecutionExploited since Nov 3, 2021 · CVSS 8.8

Latest high and critical flaws

• CVE-2026-2043 Nagios Host esensors_websensor_configwizard_func Command Injection Remote Code Execution Vulnerability.High 8.8 · Feb 20, 2026
• CVE-2026-2042 Nagios Host monitoringwizard Command Injection Remote Code Execution Vulnerability.High 8.8 · Feb 20, 2026
• CVE-2026-2041 Nagios Host zabbixagent_configwizard_func Command Injection Remote Code Execution Vulnerability.High 8.8 · Feb 20, 2026
• CVE-2025-67255 In NagiosXI 2026R1.0.1 build 1762361101, Dashboard parameters lack proper filtering, allowing any authenticated user to exploit a SQL Injection vulnerability.High 8.8 · Dec 29, 2025
• CVE-2025-67254 NagiosXI 2026R1.0.1 build 1762361101 is vulnerable to Directory Traversal in /admin/coreconfigsnapshots.php.High 7.5 · Dec 29, 2025
• CVE-2025-34323 Nagios Log Server versions prior to 2026R1.0.1 are vulnerable to local privilege escalation due to a combination of sudo misconfiguration and group-writable appHigh 8.5 · Nov 17, 2025
• CVE-2025-34322 Nagios Log Server versions prior to 2026R1.0.1 contain an authenticated command injection vulnerability in the experimental 'Natural Language Queries' feature.High 8.6 · Nov 17, 2025
• CVE-2024-13997 Nagios XI versions prior to 2024R1.1.3 contain a privilege escalation vulnerability in which an authenticated administrator could leverage the Migrate Server feCritical 9.4 · Nov 3, 2025
• CVE-2025-34298 Nagios Log Server versions prior to 2024R1.3.2 contain a privilege escalation vulnerability in the account email-change workflow.High 8.7 · Oct 30, 2025
• CVE-2025-34287 Nagios XI versions prior to 2024R2 contain an improperly owned script, process_perfdata.pl, which is executed periodically as the nagios user but owned by www-dHigh 8.4 · Oct 30, 2025
• CVE-2025-34286 Nagios XI versions prior to 2026R1 contain a remote code execution vulnerability in the Core Config Manager (CCM) Run Check command.Critical 9.4 · Oct 30, 2025
• CVE-2025-34284 Nagios XI versions prior to 2024R2 contain a command injection vulnerability in the WinRM plugin.Critical 9.4 · Oct 30, 2025
• CVE-2025-34283 Nagios XI versions prior to 2024R1.4.2 revealed API keys to users who were not authorized for API access when using Neptune themes.High 7.1 · Oct 30, 2025
• CVE-2025-34280 Nagios Network Analyzer versions prior to 2024R2.0.1 contain a vulnerability in the LDAP certificate management functionality whereby the certificate removal opHigh 8.6 · Oct 30, 2025
• CVE-2025-34277 Nagios Log Server versions prior to 2024R1.3.1 contain a code injection vulnerability where malformed dashboard ID values are not properly validated before beinCritical 9.4 · Oct 30, 2025
• CVE-2025-34274 Nagios Log Server versions prior to 2024R2.0.3 contain an execution with unnecessary privileges vulnerability as it runs its embedded Logstash process as the roCritical 9.3 · Oct 30, 2025
• CVE-2025-34273 Nagios Log Server versions prior to 2024R2.0.3 contain an incorrect authorization vulnerability that allows non-administrator users to delete global dashboards.High 7.1 · Oct 30, 2025
• CVE-2025-34271 Nagios Log Server versions prior to 2024R2.0.2 contain a vulnerability in the cluster manager component when requesting sensitive credentials from peer nodes ovHigh 8.7 · Oct 30, 2025
• CVE-2025-34134 Nagios XI versions prior to 2024R1.4.2 contain a remote code execution vulnerability in the Business Process Intelligence (BPI) component.Critical 9.4 · Oct 30, 2025
• CVE-2024-58273 Nagios Log Server versions prior to 2024R1.0.2 contain a local privilege escalation vulnerability that allows an attacker who could execute commands as the ApacHigh 8.5 · Oct 30, 2025
• CVE-2024-14009 Nagios XI versions prior to 2024R1.0.1 contain a privilege escalation vulnerability in the System Profile component.Critical 9.4 · Oct 30, 2025
• CVE-2024-14008 Nagios XI versions prior to 2024R1.3.2 contain a remote command execution vulnerability in the WinRM Configuration Wizard.Critical 9.4 · Oct 30, 2025
• CVE-2024-14006 Nagios XI versions prior to 2024R1.2.2 contain a host header injection vulnerability.High 8.8 · Oct 30, 2025
• CVE-2024-14005 Nagios XI versions prior to 2024R1.2 contain a command injection vulnerability in the Docker Wizard.Critical 9.4 · Oct 30, 2025
• CVE-2024-14004 Nagios XI versions prior to 2024R1.2 contain a privilege escalation vulnerability related to NagVis configuration handling (nagvis.conf).High 8.7 · Oct 30, 2025