CVE-2024-13997: 
Nagios XI vulnerability analysis and mitigation

Nagios XI versions prior to 2024R1.1.3 contain a privilege escalation vulnerability where an authenticated administrator could leverage the Migrate Server feature to obtain root privileges on the underlying XI host. The vulnerability was disclosed on October 30, 2025 and is tracked as CVE-2024-13997 (VulnCheck Advisory).

The vulnerability allows an authenticated administrator to abuse the migration workflow to execute actions outside the intended security scope of the application. It has been assigned a CVSS v4.0 Base Score of 9.4 Critical with the vector string CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H. The vulnerability is classified as CWE-269 (Improper Privilege Management) (VulnCheck Advisory).

A successful exploitation of this vulnerability results in full control of the operating system, as it allows an administrator to escalate their privileges to root on the underlying Nagios XI host system (VulnCheck Advisory).

Users should upgrade to Nagios XI version 2024R1.1.3 or later to remediate this vulnerability. The fix was included in the security updates released by Nagios (Nagios Changelog, Nagios Security).