CVE-2025-34286 is an OS command injection vulnerability (CWE-78) in Nagios XI versions before 2026R1. It arises from improper neutralization of special elements in the Core Config Manager's Run Check command, allowing an authenticated administrator to inject shell metacharacters into backend command lines. This leads to arbitrary command execution on the server with the privileges of the Nagios XI web application user, potentially enabling full compromise of the host system. The vulnerability has a critical CVSS 4.0 score of 9.4, reflecting its high impact and ease of exploitation given administrator access.

Successful exploitation allows an authenticated administrator to execute arbitrary commands on the Nagios XI server with the privileges of the web application user. This can lead to full control over the underlying host operating system, posing a critical risk to system confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix information is provided, organizations should monitor Nagios advisories closely and consider restricting administrator access until a fix is available. Avoid using vulnerable versions in production environments where possible.