Actively exploited in the wild

Nagios XI OS Command Injection

Nagios - Nagios XI · Listed in the CISA KEV since 2022-01-18. This indicates confirmed attacks in production environments.

Required action: Apply updates per vendor instructions.

CVE-2021-25298

HighCVSS 8.8KEV

Published: 15/02/2021(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Very high risk

75.20%

99th percentile - higher than 99% of all known CVEs

Summary

Nagios XI version xi-5.7.5 is affected by OS command injection due to improper sanitization of authenticated user input in the file /usr/local/nagiosxi/html/includes/configwizards/cloud-vm/cloud-vm.inc.php.

Risk Assessment

An attacker can execute arbitrary system commands on the Nagios XI server, leading to full system compromise and potential control over the monitored infrastructure.

Recommendation

Immediately upgrade Nagios XI to the latest patched version. Restrict administrative interface access to trusted users only.

Original NVD description (English source)

Nagios XI version xi-5.7.5 is affected by OS command injection. The vulnerability exists in the file /usr/local/nagiosxi/html/includes/configwizards/cloud-vm/cloud-vm.inc.php due to improper sanitization of authenticated user-controlled input by a single HTTP request, which can lead to OS command injection on the Nagios XI server.