Monitoring

In Nagios XI versions prior to 5.8.7 a medium severity vulnerability CVE-2021-47698 was detected. This vulnerability allows remote attackers to execute arbitrary JavaScript in a victim’s browser via the Core UI’s Views URL handling, due to insufficient validation or escaping of user-supplied input in the `escape_string()` function. To address this issue, users should upgrade Nagios XI to version 5.8.7 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2021-47698.

In Nagios XI versions prior to 2024R1.1.3 a high severity vulnerability CVE-2024-13997 was detected. This vulnerability allows an authenticated administrator to leverage the Migrate Server feature to obtain root privileges on the underlying Nagios XI host, enabling full control of the operating system. To address this issue, users should upgrade Nagios XI to version 2024R1.1.3 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-13997.

In Nagios XI versions prior to 2024R1.1.3 a high severity vulnerability CVE-2024-13998 was detected. This vulnerability allows authenticated users to access sensitive account information, including API keys and hashed passwords, that they should not have permissions for. Exposure of this data could lead to account compromise, abuse of API privileges, or offline password cracking. To address this issue, users should upgrade Nagios XI to version 2024R1.1.3 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-13998.

In Nagios XI versions prior to 2024R1.1 a medium severity vulnerability CVE-2024-13992 was detected. This vulnerability allows remote attackers to execute arbitrary JavaScript in a victim’s browser via a crafted link that targets the “missing page” (404) page, due to improper validation or escaping of user-supplied input in `page-missing.php`. To address this issue, users should upgrade Nagios XI to version 2024R1.1 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-13992.

In Zabbix Agent and Agent 2 on Windows versions 6.0.0 through 6.0.40, 7.0.0 through 7.0.17, 7.2.0 through 7.2.11, and 7.4.0 through 7.4.1 a high severity vulnerability CVE-2025-27237 was detected. The OpenSSL configuration file is loaded from a path writable by low-privileged users, allowing malicious modification and potential local privilege escalation by injecting a DLL. To address this issue, users should upgrade Zabbix to versions 6.0.41, 7.0.18, 7.2.12, or 7.4.2 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-27237.

In Zabbix versions 6.0.0 through 6.0.40, 7.0.0 through 7.0.17, 7.2.0 through 7.2.11, and 7.4.0 through 7.4.1 a medium severity vulnerability CVE-2025-49641 was detected. A regular Zabbix user with no permission to the Monitoring → Problems view is still able to call the problem.view.refresh action and retrieve a list of active problems. To address this issue, users should upgrade Zabbix to versions 6.0.41, 7.0.18, 7.2.12, or 7.4.2 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-49641.

In Zabbix versions 6.0.0 through 6.0.40, 7.0.0 through 7.0.17, 7.2.0 through 7.2.11, and 7.4.0 through 7.4.1 a medium severity vulnerability CVE-2025-27231 was identified. A Super Admin user could leak the LDAP “Bind password” by changing the LDAP “Host” to a rogue server. Although the password field is not normally readable after saving, this behavior allowed indirect exposure of sensitive credentials. To address this issue, users should upgrade Zabbix to versions 6.0.41, 7.0.18, 7.2.12, or 7.4.2 or later. For more details, see https://nvd.nist.gov/vuln/detail/CVE-2025-27231.

In Zabbix versions 6.0.38 through 6.0.40, 7.0.9 through 7.0.16, 7.2.3 through 7.2.10, and 7.4.0 a low severity vulnerability CVE-2025-27236 was identified. A regular Zabbix user could search other users in their user group via the Zabbix API by selecting fields the user does not have access to view. This allows data-mining of some field values the user does not have access to. To address this issue, users should upgrade Zabbix to versions 6.0.41, 7.0.17, 7.2.11, or 7.4.1 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-27236.

In Nagios XI versions prior to 2026R1 a high severity vulnerability CVE-2025-34227 was detected. This authenticated command injection issue affects the MongoDB Database, MySQL Query, MySQL Server, Postgres Server, and Postgres Query configuration wizards. By injecting shell characters into service arguments, an attacker could execute arbitrary system commands on the underlying host as the nagios user. To address this issue, users should upgrade to Nagios XI 2026R1 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-34227.