CVE-2026-119742

High

Description

Nagios XI before 2026R2 contains an OS command injection vulnerability in the MIB upload feature where the install_mib() function in mibs.php sanitizes uploaded filenames with an incomplete character-substitution filter that omits semicolons, pipes, and non-space IFS whitespace characters before passing them to a grep command run via exec(). An authenticated administrator can upload a MIB file with a crafted filename using tab characters to bypass the deny-list and pipe to sh via a multipart POST request to mibs.php, resulting in arbitrary OS command execution as the web server user.

SeverityHigh

CVSS7.2

Exploit probability—

ProductNagios XI

PublishedNov 3, 2026

First seenNov 4, 2026

Weakness typeCWE-78OS command injection

How to fix

Update

Nagios Enterprises, LLC Nagios XI2026R2 or later

Patches

nagios.com/security-disclosures/nagios-xi/2026r2/

Affected products

Product	Affected versions	Fixed in
Nagios Enterprises, LLC Nagios XI	v < 2026R2	2026R2

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.