CVE-2026-2041: Nagios XI Zabbix agent config wizard command injection RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

high priorityRemote authenticated command injection with high confidentiality, integrity and availability impact and a very high EPSS score, though exploitation requires valid credentials.

What it is

Nagios XI's zabbixagent_configwizard_func method fails to validate a user-supplied string before passing it to a system call, allowing OS command injection. An authenticated attacker can run arbitrary commands as the service account, and the flaw is remotely reachable over the network.

Impact

An attacker with valid credentials gains arbitrary code execution in the context of the Nagios XI service account, enabling full compromise of the host and any data or credentials that account can reach.

Attack surface

Reachable over the network via the Nagios XI web interface (AV:N) with low privileges required (PR:L) and no user interaction (UI:N). The attacker must already hold an authenticated session.

Exploitation

Not listed in CISA KEV and no public exploit reference is provided, but EPSS is very high at 0.734 (99.4th percentile), indicating elevated near-term exploitation likelihood.

What to do

• Apply the vendor fix from the Nagios XI 2026R1.0.1 release notes as soon as possible.
• Restrict access to the Nagios XI web interface to trusted networks or administrative IPs.
• Audit and minimize accounts with access to configuration wizards; enforce least privilege and strong authentication.
• Monitor the Nagios XI service account for unexpected child processes or outbound connections.
• Review logs for abnormal use of the Zabbix agent configuration wizard endpoint.

Detection

• Alert on child processes spawned by the Nagios XI web/service process, especially shells or command interpreters.
• Monitor for command metacharacters or shell syntax in requests to the Zabbix agent config wizard endpoint.
• Baseline and alert on unusual outbound network connections originating from the Nagios XI host.
• Review Nagios XI audit logs for configuration wizard actions by unexpected or low-privilege accounts.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.