CVE-2026-2041

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Nagios Host zabbixagent_configwizard_func Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Nagios Host. Authentication is required to exploit this vulnerability.

The specific flaw exists within the zabbixagent_configwizard_func method. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-28250.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

No affected versions have been published.

Timeline

Published
Feb 20, 2026
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-204106.7In imgsys, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a maliCVE-2026-204117.8In cameraisp, there is a possible escalation of privilege due to use after free. This could lead to local denial of service if a malicious aCVE-2026-204127.8In cameraisp, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a mCVE-2026-204136.7In imgsys, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a maliCVE-2026-204146.7In imgsys, there is a possible escalation of privilege due to use after free. This could lead to local escalation of privilege if a maliciouCVE-2026-204155.5In imgsys, there is a possible memory corruption due to improper locking. This could lead to local denial of service if a malicious actor haCVE-2026-204167.2In pcie, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a maliciCVE-2026-204175.3In pcie, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a maliciCVE-2026-204189.8In Thread, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation of privilege with no CVE-2026-204196.5In wlan AP/STA firmware, there is a possible system becoming irresponsive due to an uncaught exception. This could lead to remote (proximal/CVE-2026-20428.8Nagios Host monitoringwizard Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arCVE-2026-204206.5In Modem, there is a possible system crash due to incorrect error handling. This could lead to remote denial of service, if a UE has connect