CyberRota Analysis
AI-GeneratedNagios Core versions prior to 4.5.14 and Nagios XI versions before 2026R1.7 are susceptible to authenticated remote code execution due to unfiltered macro substitution in notification commands. This vulnerability allows authenticated users to execute arbitrary commands as the nagios user if the notification command improperly references the $NOTIFICATIONCOMMENT$ or $NOTIFICATIONAUTHOR$ macros in a shell-executable context. Organizations using these versions, particularly those with non-default configurations that utilize these macros, should prioritize patching to mitigate potential exploitation risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 are vulnerable to authenticated remote code execution via unfiltered NOTIFICATION-family macro substitution through the com_data parameter. When a notification command references $NOTIFICATIONCOMMENT$ or $NOTIFICATIONAUTHOR$ in a shell-reachable position, authenticated UI users can run arbitrary commands as the nagios user. Exploitation requires a non-default configuration in which a notification command references these macros in a shell-executed command line.