---
id: "CVE-2019-15949"
kind: "vulnerability"
aliases: ["CVE-2019-15949"]
title: "Nagios Nagios XI: Nagios XI Remote Code Execution Vulnerability"
severity: "critical"
cvss: 9.0
epss: 0.77039
exploited: true
status: "open"
category: "infrastructure"
products: [{"name": "Nagios Nagios XI", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "infrastructure", "nagios-xi", "self-hosted"]
not_affected_if: ["unknown"]
published_at: "2019-09-05T17:15:12+00:00"
first_seen_at: "2026-10-23T19:11:53+00:00"
updated_at: "2026-10-23T21:57:34+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-15949", "first_seen_at": "2026-10-23T19:11:53+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2019-15949", "first_seen_at": "2026-10-23T19:13:44+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-15949", "first_seen_at": "2026-10-23T21:57:34+00:00"}]
---

# Nagios Nagios XI: Nagios XI Remote Code Execution Vulnerability

Nagios XI has a remote code execution flaw in which a user can modify the check_plugin executable and insert commands that run as root. The CISA Known Exploited Vulnerabilities catalog lists it as actively exploited, with an EPSS score of 0.770.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Nagios Nagios XI affected ? fixed ?

## Fix

Apply the vendor updates per Nagios instructions; the fixed version is unknown from the sources.

## Timeline

- 2026-10-23T19:11:53+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-15949
- 2026-10-23T19:13:44+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2019-15949
- 2026-10-23T21:57:34+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2019-15949

## From the sources

Nagios XI before 5.6.6 allows remote command execution as root. The exploit requires access to the server as the nagios user, or access as the admin user via the web interface. The getprofile.sh script, invoked by downloading a system profile (profile.php?cmd=download), is executed as root via a passwordless sudo entry; the script executes check_plugin, which is owned by the nagios user. A user logged into Nagios XI with permissions to modify plugins, or the nagios user on the server, can modify the check_plugin executable and insert malicious commands to execute as root.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_