CVE-2018-8734: Nagios XI core config manager SQL injection via selInfoKey1

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

critical priorityCVSS 9.8 with no authentication or user interaction required, public exploit code available, and a very high EPSS score make this an urgent patch target.

What it is

The core config manager in Nagios XI 5.2.x through 5.4.x before 5.4.13 fails to sanitize the selInfoKey1 parameter, allowing SQL injection. Because the endpoint is network-reachable and requires no authentication, an unauthenticated attacker can run arbitrary SQL against the backend database.

Impact

An attacker can read, modify or delete data in the Nagios XI database and potentially execute arbitrary SQL commands, undermining the integrity and confidentiality of the monitoring platform.

Attack surface

Reached over the network through the core config manager component; the CVSS vector (AV:N/PR:N/UI:N) indicates no authentication and no user interaction are required.

Exploitation

Not listed in CISA KEV, but public exploit code exists (Exploit-DB 44560 and 44969, plus a third-party technical writeup) and EPSS is 0.526 (98.9th percentile), indicating high likelihood of exploitation.

What to do

• Upgrade Nagios XI to 5.4.13 or later, which the vendor change log identifies as the fix.
• Restrict network access to the Nagios XI web interface to trusted management networks.
• Review database accounts used by Nagios XI and apply least privilege.
• Audit the core config manager for other unsanitized parameters and apply input validation.
• Monitor for unexpected SQL errors or anomalous queries originating from the Nagios XI host.

Detection

• Inspect web server and application logs for requests to core config manager endpoints containing selInfoKey1 with SQL metacharacters.
• Alert on SQL error messages or unusual query patterns in the Nagios XI database logs.
• Hunt for outbound connections or data exfiltration from the Nagios XI server following suspicious config manager requests.
• Correlate Exploit-DB 44560/44969 payload signatures against IDS/IPS and WAF logs.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.