CVE-2021-38156: Nagios XI dashboard page stored XSS for admin users

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

medium priorityThe flaw requires authentication and user interaction and is rated medium by CVSS, but the very high EPSS score and public exploit references raise the practical risk.

What it is

Nagios XI before 5.8.6 contains a cross-site scripting flaw in the dashboard page (/dashboards/#) that triggers when administrative users edit a dashboard. Because the affected page is used by administrators, successful exploitation can run script in a highly privileged session.

Impact

An attacker can execute script in an authenticated administrator's browser, potentially stealing session data or performing administrative actions as that user. The scope change in the CVSS vector indicates the impact can extend beyond the vulnerable component.

Attack surface

Reached over the network via the dashboard page; the vector requires low privileges (PR:L) and user interaction (UI:R), meaning an authenticated user must be involved and an admin must interact with the crafted dashboard content.

Exploitation

Not listed in CISA KEV, but EPSS is very high (0.88939, 99.769th percentile) and third-party references are tagged Exploit, indicating public exploit material exists.

What to do

• Upgrade Nagios XI to 5.8.6 or later, which the vendor changelog identifies as the fixed release.
• Restrict dashboard editing privileges to trusted administrators and review who holds admin accounts.
• Apply output encoding and input sanitization for dashboard fields if any custom code or plugins are in use.
• Deploy a content security policy that limits inline script execution in the Nagios XI interface.

Detection

• Review Nagios XI web logs for unusual requests to /dashboards/# and dashboard edit endpoints from unexpected sources.
• Monitor for anomalous admin session activity, such as unexpected configuration changes or new dashboard content.
• Search for known XSS payload patterns in dashboard names, descriptions, or saved dashboard content.
• Alert on outbound requests or script loads originating from administrator browser sessions on the Nagios XI host.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.