CVE-2018-8735: Nagios XI OS command injection allows remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

high priorityA network-reachable authenticated RCE with public exploit code and very high EPSS probability warrants prompt patching despite the low-privilege requirement.

What it is

Nagios XI versions 5.2.x through 5.4.x before 5.4.13 contain an OS command injection flaw (CWE-78) that permits remote command execution. Because Nagios XI is a monitoring platform often run with elevated privileges and reachable from internal networks, successful exploitation can compromise the monitoring host itself.

Impact

An attacker can execute arbitrary commands on the target system, leading to full compromise of the Nagios XI host and any credentials or monitored systems it manages.

Attack surface

The vulnerability is network-reachable (AV:N) with low attack complexity and no user interaction, but requires low privileges (PR:L), meaning the attacker needs some authenticated access to the application.

Exploitation

CVE-2018-8735 is not listed in CISA KEV, but public exploit code exists (Exploit-DB 44560 and 44969, plus a third-party technical writeup), and EPSS shows a 30-day probability of roughly 0.64 (99th percentile), indicating high likelihood of exploitation activity.

What to do

• Upgrade Nagios XI to 5.4.13 or later, which the vendor change log identifies as the fixed release.
• Restrict network access to the Nagios XI web interface to trusted administrative networks only.
• Enforce least privilege and strong authentication for Nagios XI accounts, and audit for unnecessary low-privilege users.
• Run the Nagios XI service under a dedicated low-privilege account rather than root where feasible.
• Monitor vendor advisories and apply subsequent Nagios XI security updates promptly.

Detection

• Inspect Nagios XI web server and application logs for suspicious command or shell metacharacter patterns in request parameters.
• Monitor for unexpected child processes spawned by the Nagios XI web or application service (for example shells or system utilities).
• Alert on outbound network connections originating from the Nagios XI host to unfamiliar destinations.
• Review Nagios XI user accounts and authentication events for anomalous or newly created low-privilege users.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.