Remote command execution (RCE) vulnerability in Nagios XI 5.2.x through 5.4.x before 5.4.13 allows an attacker to execute arbitrary command…

1. 2016-03-06 First public exploit (Metasploit exploit/linux/http/nagios_xi_chained_rce)
2. 2018-04-18 Published

63.56% chance of exploitation in the next 30 days, higher than 99.2% of all scored CVEs (FIRST EPSS, 2026-11-09).

• Metasploit exploit/linux/http/nagios_xi_chained_rce_2_electric_boogaloo Nagios XI Chained Remote Code Execution metasploit exploit, manual rank, 2018-04-17
• Metasploit exploit/linux/http/nagios_xi_chained_rce Nagios XI Chained Remote Code Execution metasploit exploit, excellent rank, 2016-03-06
• EDB-44969 Nagios XI 5.2.6-5.4.12 - Chained Remote Code Execution (Metasploit) remote, 2018-07-02
• EDB-44560 Nagios XI 5.2.6 < 5.2.9 / 5.3 / 5.4 - Chained Remote Root webapps, 2018-04-30
• blog.redactedsec.net https://blog.redactedsec.net/exploits/2018/04/26/nagios.html referenced PoC, tagged "exploit" by a source, unverified

Weakness

• CWE-78 Improper Neutralization of Special Elements used in an OS Command

• exploit-db.com /exploits/44560/

  exploit, third-party-advisory, vdb-entry

• exploit-db.com /exploits/44969/

  exploit, third-party-advisory, vdb-entry

• blog.redactedsec.net /exploits/2018/04/26/nagios.html

  exploit, technical-description, third-party-advisory

• nagios.com /downloads/nagios-xi/change-log/

  release-notes, vendor-advisory

• assets.nagios.com /downloads/nagiosxi/CHANGES-5.TXT

  release-notes, vendor-advisory

• gist.github.com /caleBot/f0a93b5a98574393e0139104eacc2d0f

  third-party-advisory

• CVE List CVE-2018-8735
• NVD CVE-2018-8735

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.