CVE-2026-119742

{
  "etk_id": "ETK-2026-3372",
  "cve_id": "CVE-2026-119742",
  "display_id": "CVE-2026-119742",
  "ghsa_id": null,
  "euvd_id": "EUVD-2026-115824",
  "status": "published",
  "anchor_state": "anchored",
  "title": "OS command injection in Nagios XI MIB uploads",
  "summary": "Nagios XI releases before 2026R2 are affected by an OS command injection issue in MIB file upload handling. An authenticated administrator with access to upload MIBs could cause commands to run as the web server user.",
  "mitigation": "Upgrade Nagios XI to version 2026R2. Until the upgrade is complete, restrict MIB upload access to only essential, trusted administrators.",
  "vendor": "Nagios Enterprises, LLC",
  "product": "Nagios XI",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, < 2026R2"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "2026R2"
      ],
      "package_name": "Nagios XI",
      "purl": null
    }
  ],
  "cwes": [
    78
  ],
  "cvss_score": 8.6,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 110.69831621666667,
  "t0_at": "2026-11-03T13:43:57.505000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-11-03T13:43:57.505000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-11-03T13:43:57.505000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-119742"
    }
  }
}