Cyber Posture

CVE-2026-2042

High

Published: 20 February 2026

Published
20 February 2026
Modified
24 February 2026
KEV Added
—
Patch
—
CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0157 81.6th percentile
Risk Priority 19 60% EPSS · 20% KEV · 20% CVSS

Description

Nagios Host monitoringwizard Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Nagios Host. Authentication is required to exploit this vulnerability. The specific flaw exists within the monitoringwizard module. The…

more

issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-28245.

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match
prevent

Directly requires validation of user-supplied inputs before use in system calls, addressing the core cause of the command injection vulnerability in the monitoringwizard module.

SI-2 Flaw Remediation good match
prevent

Mandates identification, reporting, and correction of the specific command injection flaw, ensuring timely patching as referenced in the Nagios changelog.

AC-6 Least Privilege partial match
prevent

Enforces least privilege for the service account context, limiting the scope and impact of arbitrary code execution even if injection succeeds.

Security SummaryAI

CVE-2026-2042 is a command injection vulnerability resulting in remote code execution within the monitoringwizard module of Nagios Host. The issue stems from the lack of proper validation of user-supplied strings before they are used in system calls, affecting installations of Nagios Host. It is classified under CWE-78 (OS Command Injection) and carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

An authenticated remote attacker with low privileges can exploit this vulnerability over the network with low complexity and no user interaction required. By supplying a malicious string to the monitoringwizard module, the attacker can execute arbitrary code in the context of the service account running the Nagios Host service.

The Nagios changelog for Nagios XI 2026R1.0-1 at https://www.nagios.com/changelog/nagios-xi/nagios-xi-2026r1-0-1/ and the Zero Day Initiative advisory ZDI-26-071 at https://www.zerodayinitiative.com/advisories/ZDI-26-071/ provide further details on the vulnerability, including patch information and mitigation guidance. This issue was canonically reported as ZDI-CAN-28245.

Details

CWE(s)
CWE-78

Affected Products

nagios
nagios xi
2026

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
attack.mitre.org →
T1059.004 Unix Shell Execution
Adversaries may abuse Unix shell commands and scripts for execution.
attack.mitre.org →
T1210 Exploitation of Remote Services Lateral Movement
Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network.
attack.mitre.org →
Why these techniques?

Command injection vulnerability in web-based Nagios module enables RCE via exploitation of public-facing application (T1190), remote service exploitation (T1210), privilege escalation from low-priv to service account (T1068), and Unix shell command execution (T1059.004).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References