Live › vulnerability › CVE-2019-15949
Go to dashboardNagios XI has a remote code execution flaw in which a user can modify the check_plugin executable and insert commands that run as root. The CISA Known Exploited Vulnerabilities catalog lists it as actively exploited, with an EPSS score of 0.770.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
Apply updates per vendor instructions.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Nagios Nagios XI | vendor | – | – |
Unknown from the sources. In the analyst’s queue.
Apply the vendor updates per Nagios instructions; the fixed version is unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Nagios XI before 5.6.6 allows remote command execution as root. The exploit requires access to the server as the nagios user, or access as the admin user via the web interface. The getprofile.sh script, invoked by downloading a system profile (profile.php?cmd=download), is executed as root via a passwordless sudo entry; the script executes check_plugin, which is owned by the nagios user. A user logged into Nagios XI with permissions to modify plugins, or the nagios user on the server, can modify the check_plugin executable and insert malicious commands to execute as root.
This page as .md · .json · in your agent: get_signal("CVE-2019-15949")
CISA KEV catalog, Creative Commons 0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.