CVE-2018-8736: Nagios XI privilege escalation to root via RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

high priorityCVSS 8.8 with network reachability, low privileges required, and public exploit code, though it requires an existing RCE foothold and is not in KEV.

What it is

Nagios XI versions 5.2.x through 5.4.x before 5.4.13 contain a privilege escalation flaw that lets an attacker leverage an existing remote code execution vulnerability to gain root. Because the escalation builds on RCE, a foothold in the application can be turned into full control of the underlying host. The record does not specify the exact escalation mechanism or the CWE.

Impact

An attacker who already has code execution in Nagios XI can escalate to root, gaining full control of the monitoring server and any credentials or managed hosts it holds. This can expose the entire monitored environment to further compromise.

Attack surface

The CVSS vector is network-reachable (AV:N) with low privileges required (PR:L) and no user interaction (UI:N), so an attacker with an authenticated low-privileged account can reach it remotely. The description ties it to an RCE vulnerability, meaning the escalation is chained after initial code execution.

Exploitation

CISA KEV does not list this CVE, but EPSS is high at roughly 0.46 (98.8th percentile) and multiple references are tagged Exploit, including Exploit-DB entries 44560 and 44969, indicating public exploit code exists.

What to do

• Upgrade Nagios XI to 5.4.13 or later, which is the fixed version named in the advisory.
• Restrict network access to the Nagios XI web interface to trusted management networks only.
• Audit and minimize Nagios XI accounts, removing unnecessary low-privileged users that could be used as the escalation starting point.
• Patch or mitigate the underlying RCE vulnerability that this escalation depends on, since the chain requires it.
• Run the Nagios XI service under a least-privileged account and monitor for unexpected root-level process creation.

Detection

• Monitor for new processes spawned by the Nagios XI web or service account that run as root or use setuid binaries.
• Alert on unexpected outbound connections or command execution originating from the Nagios XI host.
• Review Nagios XI audit and web logs for exploitation attempts against known RCE endpoints preceding privilege escalation.
• Watch for changes to root-owned files, cron jobs, or systemd units on the Nagios XI server.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.