PatchTheCVECVE-2026-119742: Nagios XI before 2026R2 contains an OS command injection vulnerability in the MIB upload feature where the ins
CVE-2026-119742 is a high-severity flaw (CVSS 7.2) affecting affected software. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
Nagios XI before 2026R2 contains an OS command injection vulnerability in the MIB upload feature where the install_mib() function in mibs.php sanitizes uploaded filenames with an incomplete character-substitution filter that omits semicolons, pipes, and non-space IFS whitespace characters before passing them to a grep command run via exec(). An authenticated administrator can upload a MIB file with a crafted filename using tab characters to bypas
Why this priority
- High severity
No fix is published yet: follow the downgrade or mitigation steps.
Risk facts
| CVSS score | 7.2 (High) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | High |
| User interaction | None |
| EPSS exploit chance | n/a |
| CISA exploited list | No |
| Weakness | CWE-78 |
| Published | 2026-11-03 |
| Last modified | 2026-11-03 |
Last updated 2026-11-03 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Timeline
- Published CVE record published
- Updated Record last modified
Advisories and coverage
Research and news
- Vulners Bulletins: CVE-2026-119742 2026-11-03
- Vulners Bulletins: CVE-2026-119742 Nagios XI < 2026R2 OS Command Injection via mibs.php 2026-11-03
- Vulners Bulletins: CVE-2026-119742 Nagios XI < 2026R2 OS Command Injection via mibs.php 2026-11-03
- VulDB Recent Entries: CVE-2026-119742 | Nagios Enterprises Nagios XI up to 2026R1.7 MIB Upload Feature mibs.php install_mib os command injection 2026-11-03
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2026-119742?
No fixed release is listed yet. Watch the vendor advisory and apply any mitigation shown on this page.
Is CVE-2026-119742 being exploited?
CVE-2026-119742 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2026-119742 affect?
CVE-2026-119742 affects affected software. Severity is high (CVSS 7.2). Nagios XI before 2026R2 contains an OS command injection vulnerability in the MIB upload feature where the install_mib() function in mibs.php sanitizes uploaded filenames with an incomplete character-substitution filter that omits semicolon
How urgent is CVE-2026-119742?
Priority 25/100. High severity
Software pages
PHP vulnerabilities · Nagios vulnerabilities