CVE-2026-2043

Nagios XI contains an authenticated command injection flaw (CWE-78) in the esensors_websensor_configwizard_func method, disclosed through Trend Micro's Zero Day Initiative (ZDI-CAN-28249). The method fails to validate a user-supplied string before passing it to a system call, so a remote attacker with valid low-privilege credentials can inject operating system commands, for example via the E-sensors/WEBSensor configuration wizard component. Successful exploitation yields arbitrary code execution in the context of the service account on the Nagios host. Any organization running Nagios XI is potentially affected, though the authentication requirement limits the practical attack surface relative to unauthenticated flaws. No in-the-wild exploitation or public proof-of-concept is known and the flaw is not in CISA KEV, but its very high EPSS score (72.9% probability of exploitation within 30 days, 99th percentile) signals an elevated near-term exploitation risk.

What to do: Apply the Nagios XI security update addressing CVE-2026-2043 (ZDI-CAN-28249) as soon as it is available, since exact fixed versions are not specified in this data; verify against the Nagios/ZDI advisory. Until patched, restrict access to the Nagios XI web interface to trusted networks, minimize and monitor low-privilege accounts that can reach the configuration wizard, and watch the service account for unexpected process or command activity. Check whether the E-sensors/WEBSensor wizard component is in use and review logs for anomalous requests to its endpoints.