CVE-2025-34284.

Disclosure summary

Nagios XI versions prior to 2024R2 contain a command injection vulnerability in the WinRM plugin. Insufficient validation of user-supplied parameters allows an authenticated administrator to inject shell metacharacters that are incorporated into backend command invocations. Successful exploitation enables arbitrary command execution with the privileges of the Nagios XI web application user and can be leveraged to modify configuration, exfiltrate data, disrupt monitoring operations, or execute commands on the underlying host operating system.

Source-reported weakness categories

CWE-78

Source-specific records & product guidance

Sources retain their own attribution and scoring. Follow the original record to confirm affected versions, fixed releases, and configuration conditions.

Original records & references

• NIST NVD record
• CVE Program record
• www.nagios.com — Release Notes
• www.nagios.com — Vendor Advisory
• www.vulncheck.com — Third Party Advisory

PUBLISHED 2025-10-30T18:15:48-04:00
MODIFIED 2026-10-07T17:10:00-04:00
INGESTED 2026-10-08T12:35:14-04:00