This vulnerability involves improper neutralization of special elements used in OS command execution within Nagios Core and Nagios XI. Authenticated users can exploit unfiltered NOTIFICATION-family macro substitutions through the com_data parameter to perform remote code execution as the nagios user. The attack vector requires that notification commands reference $NOTIFICATIONCOMMENT$ or $NOTIFICATIONAUTHOR$ macros in a shell-reachable position, which is not the default configuration. The CVSS 4.0 base score is 7.7, indicating high severity with network attack vector, low attack complexity, and partial privileges required.

Successful exploitation allows an authenticated user with limited privileges to execute arbitrary commands on the underlying operating system as the nagios user. This can lead to unauthorized system control or data compromise depending on the privileges of the nagios user. The vulnerability requires specific non-default configurations to be exploitable.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, review and avoid configurations where notification commands reference $NOTIFICATIONCOMMENT$ or $NOTIFICATIONAUTHOR$ macros in shell-executed command lines. Restrict authenticated user permissions to minimize risk.