Vulnerability Description
Nagios XI < 2026R1 is vulnerable to an authenticated command injection vulnerability within the MongoDB Database, MySQL Query, MySQL Server, Postgres Server, and Postgres Query wizards. It is possible to inject shell characters into arguments provided to the service and execute arbitrary system commands on the underlying host as the `nagios` user.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Nagios | Nagios Xi | <= 2026 |
Related Weaknesses (CWE)
References
- https://theyhack.me/CVE-2025-34227-Nagios-XI-Wizard-Command-Injection/ExploitThird Party Advisory
- https://www.nagios.com/changelog/Release Notes
- https://www.nagios.com/products/security/Vendor Advisory
- https://www.vulncheck.com/advisories/nagios-xi-config-wizard-auth-command-injectThird Party Advisory
FAQ
What is CVE-2025-34227?
CVE-2025-34227 is a vulnerability with a CVSS score of 8.8 (HIGH). Nagios XI < 2026R1 is vulnerable to an authenticated command injection vulnerability within the MongoDB Database, MySQL Query, MySQL Server, Postgres Server, and Postgres Query wizards. It is possible...
How severe is CVE-2025-34227?
CVE-2025-34227 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2025-34227?
Check the references section above for vendor advisories and patch information. Affected products include: Nagios Nagios Xi.