CVE-2026-2041

What it actually does

This is an authenticated remote command injection vulnerability in the Nagios Host Zabbix agent configuration wizard function, specifically in handling of user-supplied input passed into a system call without sufficient validation or escaping. A low-privileged authenticated attacker can inject shell metacharacters or command payloads into the vulnerable wizard workflow and cause arbitrary operating system commands to execute in the context of the Nagios service or web application account. Successful exploitation can provide full confidentiality, integrity, and availability impact on the monitoring server, including access to monitoring configuration, credentials, host inventories, scripts, plugins, and the ability to pivot through trusted monitoring integrations. Note: the provided affected package list references AlmaLinux 8 Poppler packages, which appears inconsistent with the Nagios command-injection description; validate the authoritative vendor advisory and package mapping before relying on package-only remediation evidence.

Why it matters to the business

A compromised monitoring platform can give attackers a central view of infrastructure, credentials, scripts, alerting workflows, and administrative integrations, making this vulnerability operationally significant even though authentication is required. Because monitoring systems often have broad network reach and trusted access to production assets, exploitation may lead to service disruption, stealthy reconnaissance, credential theft, or lateral movement. The EPSS score is high, indicating elevated likelihood of exploitation activity, and the issue has been public for 171 days, so exposed or internet-accessible instances should be treated as urgent even though it is not currently listed in CISA KEV and no ransomware use is reported.

How an attack unfolds

An attacker first obtains valid credentials for the affected Nagios web interface, such as through phishing, password reuse, credential stuffing, or compromise of a low-privileged account. The attacker then accesses the Zabbix agent configuration wizard or the underlying request handler that invokes zabbixagent_configwizard_func. By placing shell metacharacters or command substitution syntax into a vulnerable input field, the attacker causes the server-side code to concatenate untrusted data into a system command. When the wizard processes the request, the injected command is executed by the operating system under the service account used by the Nagios web process. The attacker can use this initial command execution to verify access, download tooling, create a reverse shell, read configuration files, extract credentials or API tokens, modify monitoring checks, tamper with alerts, or pivot to monitored systems reachable from the Nagios host.

How to fix it

Apply the vendor-provided fix for the affected Nagios Host/Nagios component as soon as it is available, prioritizing externally reachable or broadly accessible monitoring servers. If the supplied AlmaLinux package mapping is authoritative for the deployed asset, update the listed AlmaLinux 8 packages to fixed version 20.11.0-13.el8_10 or later: poppler, poppler-cpp, poppler-cpp-devel, poppler-devel, poppler-glib, poppler-glib-devel, poppler-glib-doc, poppler-qt5, poppler-qt5-devel, and poppler-utils. Because the package list appears inconsistent with the vulnerability description, confirm remediation against the official Nagios and operating-system advisories rather than assuming Poppler package updates alone address the Nagios command injection. Until patched, restrict access to the Nagios administrative web interface to trusted management networks or VPN, disable or remove the vulnerable Zabbix agent configuration wizard if not required, enforce MFA for administrative access, review and reduce user privileges, block direct internet exposure, and apply web application firewall rules or reverse-proxy filtering for command-injection metacharacters in wizard requests. Harden the service account by limiting shell access, file-write locations, outbound network access, and privileges available to the Nagios web process.

How to confirm the fix worked

Confirm the installed Nagios component version and the presence or absence of the vulnerable Zabbix agent configuration wizard against the official vendor advisory. Where AlmaLinux package remediation applies, verify package versions with package management tooling and confirm each listed package is at 20.11.0-13.el8_10 or later. Review whether the vulnerable wizard endpoint is reachable from untrusted networks and whether non-administrative users can access it. Perform a safe validation test in an authorized non-production environment by submitting benign shell metacharacter payloads that should be rejected or treated as literal input, not executed. After remediation, confirm that wizard inputs are validated, shell metacharacters are escaped or rejected, and no child shell process is spawned from the web application when processing crafted input. Also confirm compensating controls such as MFA, network allowlisting, and removal of unused configuration wizards remain in place.

Typical attack path

1. Acquire valid credentials for the affected Nagios web application or an account allowed to access configuration wizard functionality.
2. Navigate to, or directly send requests against, the Zabbix agent configuration wizard workflow.
3. Submit crafted input containing shell metacharacters, command substitution, or chained shell commands in a vulnerable field processed by zabbixagent_configwizard_func.
4. Trigger server-side processing so the application passes the unvalidated value into an operating system call.
5. Execute commands as the Nagios service or web server account.
6. Establish persistence or interactive access, such as by writing files, adding keys, launching a reverse shell, or modifying scheduled tasks/scripts.
7. Collect sensitive monitoring configuration, credentials, host inventories, tokens, plugin scripts, and network topology information.
8. Use the monitoring server’s trusted access to pivot, disrupt alerting, or conceal additional activity.

How to detect it

Look for evidence of authenticated access to the Nagios Zabbix agent configuration wizard followed by suspicious command execution from the web or Nagios service account. Review Nagios application logs, Nagios audit logs, Apache/httpd or nginx access and error logs, authentication logs, sudo logs, auditd or process accounting data, EDR telemetry, shell histories, temporary directories, plugin directories, cron/systemd changes, and outbound firewall/proxy/DNS logs. Focus on POST requests to Nagios configuration wizard paths containing shell metacharacters such as semicolons, pipes, backticks, $(), redirection operators, encoded command separators, or strings associated with command execution and download utilities. Correlate those requests with child processes spawned by httpd, apache, nginx, php-fpm, or nagios, especially /bin/sh, bash, curl, wget, nc, python, perl, or chmod. Also investigate unexpected modifications to Nagios configuration, notification handlers, event handlers, plugins, SSH keys, web-accessible files, and scheduled jobs. If threat hunting identifies suspicious wizard activity, assume credentials accessible to the Nagios service account may be compromised and perform secret rotation and lateral movement review.

• zabbixagent_configwizard_func
• /nagiosxi/includes/configwizards/zabbixagent/
• /nagiosxi/config/configwizard.php
• zabbixagent
• ;curl
• ;wget
• |bash
• |sh
• `id`
• $(id)
• /bin/sh -c
• bash -c
• nc -e /bin/sh
• python -c 'import socket
• perl -e 'use Socket
• chmod +x /tmp/
• /tmp/revshell
• /tmp/.x
• /var/lib/nagios/.ssh/authorized_keys
• /usr/local/nagios/libexec/
• /usr/local/nagiosxi/var/cmdsubsys.log
• /usr/local/nagiosxi/var/eventman.log
• /usr/local/nagiosxi/var/auditlog.log

What your security team should do

• Prioritize inventory of Nagios Host/Nagios instances and determine whether the Zabbix agent configuration wizard is installed and reachable.
• Treat internet-exposed or broadly accessible Nagios administrative interfaces as high priority because the EPSS score is elevated and the vulnerability has been public for 171 days.
• Patch affected systems using the authoritative vendor advisory; if the AlmaLinux package list applies, upgrade all listed Poppler packages to 20.11.0-13.el8_10 or later, but verify the apparent product mismatch before closing remediation.
• Restrict Nagios web access to trusted management networks, require MFA, and remove unnecessary local or low-privileged accounts.
• Disable the vulnerable Zabbix agent configuration wizard if it is not required for operations.
• Hunt for prior exploitation using web logs, Nagios audit logs, shell/process telemetry, and suspicious outbound connections from the monitoring server.
• Review credentials, API tokens, SSH keys, notification integrations, and plugin scripts stored on or accessible from the monitoring server for possible exposure.
• Rotate secrets accessible to the Nagios service account if exploitation is suspected or cannot be ruled out.
• Monitor for child shell processes, download utilities, reverse-shell behavior, and unexpected file writes initiated by the web server or Nagios service account.
• Ensure monitoring alerts cannot be silently disabled or modified without administrative review.