CVE-2026-119742

Read full description

Nagios XI before 2026R2 contains an OS command injection vulnerability in the MIB upload feature where the install_mib() function in mibs.php sanitizes uploaded filenames with an incomplete character-substitution filter that omits semicolons, pipes, and non-space IFS whitespace characters before passing them to a grep command run via exec(). An authenticated administrator can upload a MIB file with a crafted filename using tab characters to bypass the deny-list and pipe to sh via a multipart POST request to mibs.php, resulting in arbitrary OS command execution as the web server user.

CVSS 7.2 (HIGH)

Attention and evidence

HYPE SCORE

0.0/10

REALITY · THREAT PRIORITY

2.6/10

General review priority; not probability

Evidence confidence: Insufficient evidence

Why this priority?

Technical severity: CVSS 7.2: +2.52
Fresh EPSS: 4.09%: +0.10

General review priority, not probability, victim count or asset-specific risk. A range covers missing CVSS/EPSS inputs within the current evidence state.

Based on public data to date.

Hype components

Headline sample (25%)

0/100

Press, 30 days (60%)

0/100

Grounded branding (15%)

0/100

HYPE TOTAL0/100

Sources and documents

No source documents yet.

Score evolution

● Hype ● Reality

First record: hype 0.0 · reality 2.6 (2026-11-04 13:50). The curve appears once the score changes.

Public exploit evidence

Public exploit entries / repo candidates

Evidence context and dated references

Reality is general threat/review priority, combining observed exploitation, CVSS severity and fresh EPSS. Evidence confidence is separate. This is not calibrated risk, a victim count or an asset-specific assessment. A range reflects missing numeric inputs. Published 4 days ago. Exploitation evidence usually takes weeks to show up: a low reality score can mean there is no data yet, not that the flaw is mild.

Evidence in context

Confidence in exploitation evidence: Insufficient evidence
Priority basis: Exploitation in attacks unconfirmed; CVSS 7.2; EPSS 4.1%
Attention, last 30 days: 0 distinct story titles; 0 press documents; 0 publisher domains.
Technical potential: network access, high privileges, no user interaction.
Observed activity: No exploitation observation is recorded.
Known scale: Not quantified.
Evidence confidence basis: Insufficient evidence

Score evaluated: 2026-11-05 13:59:55.835577+00:00 · EPSS snapshot: 2026-11-05T12:03:04Z

Source event timeline

Published

03 Nov 2026, 13:43

Score calculated

05 Nov 2026, 13:59