Nagios XI versions prior to 2024R1 contain a missing access control vulnerability via the Web SSH Terminal. A remote, low-privileged attacker could access or interact with the terminal interface without sufficient authorization, potentially allowing unauthorized command execution or disclosure of sensitive information.
Fix
Patch, vendor advisory and mitigation references on NVD 1
- https://www.nagios.com/products/security/#nagios-xi Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 9.4 · nagiosNVD modified 2026-10-18 00:10
Affected (CPE criteria) 1
cpe:2.3:a:nagios:nagios_xi:*:*:*:*:*:*:*:*
References 3
- https://www.nagios.com/changelog/nagios-xi/ Release Notes
- https://www.nagios.com/products/security/#nagios-xi Vendor Advisory
- https://www.vulncheck.com/advisories/nagios-xi-web-ssh-terminal-missing-access-control Third Party Advisory