CVE WatchJul 9, 2026

CVE-2021-25297

Nagios XI OS Command Injection

CVSS

8.8

High

EPSS

56.7%

p99

KEV

YES

Jan 18, 2022

Exploit Today

0-100

Published: Feb 15, 2021 · Last modified: Jul 9, 2026 · CWE-78

EPSS · 30d

56.7%EPSS · 30 days56.7%

2026-09-162026-10-14

KEV catalog record

Product

Nagios / Nagios XI

Vulnerability

Nagios XI OS Command Injection

Added to KEV

Jan 18, 2022

Remediate by

Feb 1, 2022

Known ransomware use

Summary description

Nagios XI contains a vulnerability which can lead to OS command injection on the Nagios XI server.

Required action

Apply updates per vendor instructions.

Notes

https://nvd.nist.gov/vuln/detail/CVE-2021-25297

Technical description

Nagios XI version xi-5.7.5 is affected by OS command injection. The vulnerability exists in the file /usr/local/nagiosxi/html/includes/configwizards/switch/switch.inc.php due to improper sanitization of authenticated user-controlled input by a single HTTP request, which can lead to OS command injection on the Nagios XI server.

Official references

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-47786—

—

———An OS command injection vulnerability has been reported to affect HybridDesk Station. If exploited, the vulnerability could allow remote attackers to execute arbitrary commands. We have already fixed the vulnerability in the following version: HybridDesk Station 4.2.23 and later HybridDesk Station 4.3.4 and later8h CVE-2026-41545—

—

———A relative path traversal vulnerability has been reported to affect QuMagie. If a remote attacker gains an administrator account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: QuMagie 2.9.1 and later8h CVE-2026-34007—

—

———An OS command injection vulnerability has been reported to affect Notes Station 3. If exploited, the vulnerability could allow remote attackers to execute arbitrary commands. We have already fixed the vulnerability in the following version: Notes Station 3 3.9.11 and later8h CVE-2026-1109255.4 MED

—

———A flaw was found in OpenSSH. A username entered on the ssh command line can still contain '$' or a non-trailing backslash. When a configuration expands %u inside ProxyCommand or Match exec, those characters are passed into the shell.6h CVE-2026-1109088.8 HIG

—

———Netgate pfSense FRR package (pfSense-pkg-frr) 2.0.2_1 and source revision 2.1.2_1 contain an OS command injection vulnerability in the FRR status filter. An authenticated WebGUI user with only the page-status-frr privilege can supply a filter value that breaks out of a single-quoted sed expression into which escapeshellarg() output is concatenated. Shell command substitution is then evaluated by a popen() pipeline, allowing attacker-selected commands to execute as root. There are updated FRR packages for pfSense Plus 26.07/26.03.1 and CE 2.9.0/2.8.1.15h CVE-2026-100232—

—

——0Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability has been identified in the SonicWall Network Security Manager (NSM) on-prem which in specific conditions could potentially enable a remote authenticated attacker to execute arbitrary OS commands, resulting in remote code execution.21h