---
id: "CVE-2021-25298"
kind: "vulnerability"
aliases: ["CVE-2021-25298"]
title: "Nagios Nagios XI: Nagios XI OS Command Injection"
severity: "critical"
cvss: 9.0
epss: 0.73641
exploited: true
status: "open"
category: "infrastructure"
products: [{"name": "Nagios Nagios XI", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "infrastructure", "nagios-xi", "self-hosted"]
not_affected_if: ["unknown"]
published_at: "2021-02-15T13:15:12+00:00"
first_seen_at: "2026-10-23T19:11:53+00:00"
updated_at: "2026-10-23T21:57:35+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-25298", "first_seen_at": "2026-10-23T19:11:53+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2021-25298", "first_seen_at": "2026-10-23T19:13:44+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-25298", "first_seen_at": "2026-10-23T21:57:35+00:00"}]
---

# Nagios Nagios XI: Nagios XI OS Command Injection

Nagios XI, a server monitoring product, has an OS command injection flaw that lets input run shell commands on the server. An attacker who can reach it can run commands as the Nagios XI server process.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Nagios Nagios XI affected ? fixed ?

## Fix

Apply the vendor update per Nagios instructions; the fixed version is unknown from the sources.

## Timeline

- 2026-10-23T19:11:53+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-25298
- 2026-10-23T19:13:44+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2021-25298
- 2026-10-23T21:57:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2021-25298

## From the sources

Nagios XI version xi-5.7.5 is affected by OS command injection. The vulnerability exists in the file /usr/local/nagiosxi/html/includes/configwizards/cloud-vm/cloud-vm.inc.php due to improper sanitization of authenticated user-controlled input by a single HTTP request, which can lead to OS command injection on the Nagios XI server.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_