Vendor scorecard

Nagios

Nagios security disclosure record — CVE volume, CVSS severity mix and product-category breakdown, sourced from the NIST NVD.

CPE: nagios

Product families

Open in latest

113

Inferred — see methodology

Last disclosure

Feb 20, 2026

Product categories

1 tracked

CVE volume, severity mix and the inferred latest shipping version per category.

Category	CVEs	Volume	Severity mix	Open	Inferred latest
NagiosNetwork Management & Monitoringnagios, nagios_xi, nagios_core	6			113	4.4.1LOW

Each count is distinct CVEs within that category. A CVE affecting more than one category is counted in each, so these can sum to more than the Nagios total above.

Disclosure trend

12 months

Cumulative CVEs published on or before each month-end over the last 12 months, stacked by CVSS severity. A fixed 12-month window — independent of the date filter above.

Critical
High
Medium
Low

Recent CVEs

6 shown

Most recently published, newest first. Each ID links to its NVD record.

Recent CVEs affecting Nagios
CVE	Severity	CVSS	Summary	Published
CVE-2026-2043(opens NVD record)	High	8.8	Nagios Host esensors_websensor_configwizard_func Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Nagios Host. Authentication is required to exploit this vulnerability. The specific flaw exists within the esensors_websensor_configwizard_func method. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-28249.	Feb 20, 2026
CVE-2026-2042(opens NVD record)	High	8.8	Nagios Host monitoringwizard Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Nagios Host. Authentication is required to exploit this vulnerability. The specific flaw exists within the monitoringwizard module. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-28245.	Feb 20, 2026
CVE-2026-2041(opens NVD record)	High	8.8	Nagios Host zabbixagent_configwizard_func Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Nagios Host. Authentication is required to exploit this vulnerability. The specific flaw exists within the zabbixagent_configwizard_func method. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-28250.	Feb 20, 2026
CVE-2025-67255(opens NVD record)	High	8.8	In NagiosXI 2026R1.0.1 build 1762361101, Dashboard parameters lack proper filtering, allowing any authenticated user to exploit a SQL Injection vulnerability.	Dec 29, 2025
CVE-2025-67254(opens NVD record)	High	7.5	NagiosXI 2026R1.0.1 build 1762361101 is vulnerable to Directory Traversal in /admin/coreconfigsnapshots.php.	Dec 29, 2025
CVE-2025-34288(opens NVD record)	Medium	6.7	Nagios XI versions prior to 2026R1.1 are vulnerable to local privilege escalation due to an unsafe interaction between sudo permissions and application file permissions. A user‑accessible maintenance script may be executed as root via sudo and includes an application file that is writable by a lower‑privileged user. A local attacker with access to the application account can modify this file to introduce malicious code, which is then executed with elevated privileges when the script is run. Successful exploitation results in arbitrary code execution as the root user.	Dec 16, 2025

6 CVEs · 1 product families