CVE-2026-2041: Nagios Host zabbixagent_configwizard_func Command Injection Remote Code Execution Vulnerability
Nagios Host zabbixagentconfigwizardfunc Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Nagios Host. Authentication is required to exploit this vulnerability.
The specific flaw exists within the zabbixagentconfigwizardfunc method. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-28250.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-2041?
The severity of CVE-2026-2041 is classified as critical due to the potential for remote code execution.
How do I fix CVE-2026-2041?
To fix CVE-2026-2041, update your Nagios Host installation to the latest patched version immediately.
What systems are affected by CVE-2026-2041?
CVE-2026-2041 affects installations of Nagios Host that have not been updated to mitigate this vulnerability.
What kind of attack can be executed through CVE-2026-2041?
CVE-2026-2041 allows remote attackers to perform arbitrary code execution through command injection.
How can I identify if my system is vulnerable to CVE-2026-2041?
You can identify if your system is vulnerable to CVE-2026-2041 by checking if you are running an outdated version of Nagios Host.