CVE-2026-119742— Nagios XI < 2026R2 OS Command Injection via mibs.php

Quick assessment

Affected

Nagios Enterprises, LLC Nagios XI

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Nagios XI 在 2026R2 之前的版本中，其 MIB 上传功能存在操作系统命令注入漏洞。该漏洞源于文件中的函数：该函数在将上传的文件名传递给通过执行的命令之前，使用了一个不完整的字符黑名单进行过滤，该黑名单遗漏了分号（;）和管道符（

CVSS 7.2 · High Updated Nov 04, 2026

Possible ATT&CK Techniques 2 AI

T1059 · Command and Scripting Interpreter T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Nagios XI < 2026R2 OS Command Injection via mibs.php

Source: CVE Program / CVE List V5

Vulnerability Description

Nagios XI before 2026R2 contains an OS command injection vulnerability in the MIB upload feature where the install_mib() function in mibs.php sanitizes uploaded filenames with an incomplete character-substitution filter that omits semicolons, pipes, and non-space IFS whitespace characters before passing them to a grep command run via exec(). An authenticated administrator can upload a MIB file with a crafted filename using tab characters to bypass the deny-list and pipe to sh via a multipart POST request to mibs.php, resulting in arbitrary OS command execution as the web server user.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

OS命令中使用的特殊元素转义处理不恰当(OS命令注入)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Nagios Enterprises, LLC	Nagios XI	0 ~ 2026R2	-

II. Public POCs for CVE-2026-119742

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-119742

请登录查看更多情报信息。

Other References for CVE-2026-119742 (2)

https://www.nagios.com/security-disclosures/nagios-xi/2026r2/ release-notes patch
https://www.vulncheck.com/advisories/nagios-xi-2026r2-os-command-injection-via-mibs-php third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-119742

IV. Related Vulnerabilities

Same product: Nagios XI

Same weakness: CWE-78