Nagios has 52 CVEs on record between 2021 and 2026. 2 were published in the last 90 days. The median CVSS is 7.3 (high), with 8 rated critical. 6% have been exploited in the wild, in line with the corpus average. The median gap from publication to a KEV listing is 337 days (3 cases). The dominant weakness classes are CWE-78 (11) and CWE-79 (8). Most affected products: nagios_xi (36), log_server (12), Nagios XI (2).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 6% vs 1% corpus
- Median CVSS
- 7.3
- Publish → KEV
- 337 d median(3)
- Last 90 days
- 2 prev 0
Products
- nagios_xi 36
- log_server 12
- Nagios XI 2
- network_analyzer 2
Worst active — by depth score
CVE-2021-25298High· 8.8Nagios XI version xi-5.7.5 is affected by OS command injection88CVE-2021-25296High· 8.8Nagios XI version xi-5.7.5 is affected by OS command injection88CVE-2021-25297High· 8.8Nagios XI version xi-5.7.5 is affected by OS command injection85CVE-2025-44823Critical· 9.9Nagios Log Server before 2024R1.3.2 allows authenticated users to retrieve cleartext administrative API keys via a /nagioslogserver/index.php/api/system/get_users call70CVE-2025-34227High· 8.8Nagios XI < 2026R1 is vulnerable to an authenticated command injection vulnerability within the MongoDB Database, MySQL Query, MySQL Server, Postgres Server, and Postgres Query wizards66
Nagios vulnerabilities
CVEs affecting Nagios, newest first. Open any entry for full detail, references, and exploit status.
52 CVEsRSS
CVE-2024-14002Medium· 5.5Nagios XI versions prior to 2024R1.1.4 contain a local file inclusion (LFI) vulnerability via its NagVis integration. An authenticated user can supply crafted path values that cause the server to include local files, potentially exposing…
Nagios XI versions prior to 2024R1.1.4 contain a local file inclusion (LFI) vulnerability via its NagVis integration. An authenticated user can supply crafted path values that cause the server to include local files, potentially exposing…
CVE-2024-14006Medium· 6.1⚖ disputedNagios XI versions prior to 2024R1.2.2 contain a host header injection vulnerability
Nagios XI versions prior to 2024R1.2.2 contain a host header injection vulnerability. The application trusts the user-supplied HTTP Host header when constructing absolute URLs without sufficient validation. An unauthenticated, remote att…
CVE-2024-14005High· 8.8Nagios XI versions prior to 2024R1.2 contain a command injection vulnerability in the Docker Wizard
Nagios XI versions prior to 2024R1.2 contain a command injection vulnerability in the Docker Wizard. Insufficient validation of user-supplied input in the wizard allows an authenticated administrator to inject shell metacharacters that a…
CVE-2024-14009High· 7.2⚖ disputedNagios XI versions prior to 2024R1.0.1 contain a privilege escalation vulnerability in the System Profile component
Nagios XI versions prior to 2024R1.0.1 contain a privilege escalation vulnerability in the System Profile component. The System Profile feature is an administrative diagnostic/configuration capability. Due to improper access controls and…
CVE-2024-14008High· 7.2⚖ disputedNagios XI versions prior to 2024R1.3.2 contain a remote command execution vulnerability in the WinRM Configuration Wizard
Nagios XI versions prior to 2024R1.3.2 contain a remote command execution vulnerability in the WinRM Configuration Wizard. Insufficient validation of user-supplied input allows an authenticated administrator to inject shell metacharacter…
CVE-2025-34284High· 8.8Nagios XI versions prior to 2024R2 contain a command injection vulnerability in the WinRM plugin
Nagios XI versions prior to 2024R2 contain a command injection vulnerability in the WinRM plugin. Insufficient validation of user-supplied parameters allows an authenticated administrator to inject shell metacharacters that are incorpora…
CVE-2025-34134High· 7.2⚖ disputedNagios XI versions prior to 2024R1.4.2 contain a remote code execution vulnerability in the Business Process Intelligence (BPI) component
Nagios XI versions prior to 2024R1.4.2 contain a remote code execution vulnerability in the Business Process Intelligence (BPI) component. Insufficient validation and sanitization of administrator-controlled BPI configuration parameters …
CVE-2025-34283Medium· 6.5Nagios XI versions prior to 2024R1.4.2 revealed API keys to users who were not authorized for API access when using Neptune themes
Nagios XI versions prior to 2024R1.4.2 revealed API keys to users who were not authorized for API access when using Neptune themes. An authenticated user without API privileges could view another user's or their own API key value.
CVE-2025-34135Medium· 4.4Nagios XI versions prior to 2024R1.4.2 configure some systemd unit files with permission sets that were too permissive
Nagios XI versions prior to 2024R1.4.2 configure some systemd unit files with permission sets that were too permissive. In particular, the nagios.service unit had executable permissions that were not required. Overly permissive permissio…
CVE-2023-7314Medium· 5.4Nagios XI versions prior to 5.11.3 are vulnerable to cross-site scripting (XSS) via the Bandwidth Report component. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script i…
Nagios XI versions prior to 5.11.3 are vulnerable to cross-site scripting (XSS) via the Bandwidth Report component. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script i…
CVE-2023-7313Medium· 5.4Nagios XI versions prior to 5.11.3 are vulnerable to cross-site scripting (XSS) via the Bulk Modifications tool
Nagios XI versions prior to 5.11.3 are vulnerable to cross-site scripting (XSS) via the Bulk Modifications tool. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in t…
CVE-2025-44824High· 8.5Nagios Log Server before 2024R1.3.2 allows authenticated users (with read-only API access) to stop the Elasticsearch service via a /nagioslogserver/index.php/api/system/stop?subsystem=elasticsearch call
Nagios Log Server before 2024R1.3.2 allows authenticated users (with read-only API access) to stop the Elasticsearch service via a /nagioslogserver/index.php/api/system/stop?subsystem=elasticsearch call. The service stops even though "me…
CVE-2025-44823Critical· 9.9PoCNagios Log Server before 2024R1.3.2 allows authenticated users to retrieve cleartext administrative API keys via a /nagioslogserver/index.php/api/system/get_users call
Nagios Log Server before 2024R1.3.2 allows authenticated users to retrieve cleartext administrative API keys via a /nagioslogserver/index.php/api/system/get_users call. This is GL:NLS#475.
CVE-2025-34227High· 8.8PoCNagios XI < 2026R1 is vulnerable to an authenticated command injection vulnerability within the MongoDB Database, MySQL Query, MySQL Server, Postgres Server, and Postgres Query wizards
Nagios XI < 2026R1 is vulnerable to an authenticated command injection vulnerability within the MongoDB Database, MySQL Query, MySQL Server, Postgres Server, and Postgres Query wizards. It is possible to inject shell characters into argu…
CVE-2024-13986High· 8.8Nagios XI < 2024R1.3.2 contains a remote code execution vulnerability by chaining two flaws: an arbitrary file upload and a path traversal in the Core Config Snapshots interface
Nagios XI < 2024R1.3.2 contains a remote code execution vulnerability by chaining two flaws: an arbitrary file upload and a path traversal in the Core Config Snapshots interface. The issue arises from insufficient validation of file path…
CVE-2024-33775High· 8.8PoCAn issue with the Autodiscover component in Nagios XI 2024R1.01 allows a remote attacker to escalate privileges via a crafted Dashlet.
An issue with the Autodiscover component in Nagios XI 2024R1.01 allows a remote attacker to escalate privileges via a crafted Dashlet.
CVE-2021-37223Medium· 6.5Nagios Enterprises NagiosXI <= 5.8.4 contains a Server-Side Request Forgery (SSRF) vulnerability in schedulereport.php
Nagios Enterprises NagiosXI <= 5.8.4 contains a Server-Side Request Forgery (SSRF) vulnerability in schedulereport.php. Any authenticated user can create scheduled reports containing PDF screenshots of any view in the NagiosXI applicatio…
CVE-2021-37345High· 7.8Nagios XI before version 5.8.5 is vulnerable to local privilege escalation because xi-sys.cfg is being imported from the var directory for some scripts with elevated permissions.
Nagios XI before version 5.8.5 is vulnerable to local privilege escalation because xi-sys.cfg is being imported from the var directory for some scripts with elevated permissions.
CVE-2021-25298High· 8.8CISA KEVPoCNagios XI version xi-5.7.5 is affected by OS command injection
Nagios XI version xi-5.7.5 is affected by OS command injection. The vulnerability exists in the file /usr/local/nagiosxi/html/includes/configwizards/cloud-vm/cloud-vm.inc.php due to improper sanitization of authenticated user-controlled …
CVE-2021-25297High· 8.8CISA KEVPoCNagios XI version xi-5.7.5 is affected by OS command injection
Nagios XI version xi-5.7.5 is affected by OS command injection. The vulnerability exists in the file /usr/local/nagiosxi/html/includes/configwizards/switch/switch.inc.php due to improper sanitization of authenticated user-controlled inpu…
CVE-2021-25296High· 8.8CISA KEVPoCNagios XI version xi-5.7.5 is affected by OS command injection
Nagios XI version xi-5.7.5 is affected by OS command injection. The vulnerability exists in the file /usr/local/nagiosxi/html/includes/configwizards/windowswmi/windowswmi.inc.php due to improper sanitization of authenticated user-control…
CVE-2021-25299Medium· 6.1PoCNagios XI version xi-5.7.5 is affected by cross-site scripting (XSS)
Nagios XI version xi-5.7.5 is affected by cross-site scripting (XSS). The vulnerability exists in the file /usr/local/nagiosxi/html/admin/sshterm.php due to improper sanitization of user-controlled input. A maliciously crafted URL, when …