CVE-2026-2043

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Nagios Host esensors_websensor_configwizard_func Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Nagios Host. Authentication is required to exploit this vulnerability.

The specific flaw exists within the esensors_websensor_configwizard_func method. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-28249.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

No affected versions have been published.

Timeline

Published
Feb 20, 2026
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-204308.8In wlan AP FW, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote (proximal/adjacent) escalCVE-2026-204316.5In Modem, there is a possible system crash due to a logic error. This could lead to remote denial of service, if a UE has connected to a rogCVE-2026-204328.0In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation of privilege, if a UE CVE-2026-204338.8In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation of privilege, if a UE CVE-2026-204347.5In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation of privilege, if a UE CVE-2026-204354.6In preloader, there is a possible read of device unique identifiers due to a logic error. This could lead to local information disclosure, iCVE-2026-204366.7In wlan STA driver, there is a possible escalation of privilege due to a missing bounds check. This could lead to local escalation of privilCVE-2026-204374.4In MAE, there is a possible system crash due to use after free. This could lead to local denial of service if a malicious actor has already CVE-2026-204386.4In MAE, there is a possible out of bounds write due to a race condition. This could lead to local escalation of privilege if a malicious actCVE-2026-204394.4In imgsys, there is a possible system crash due to use after free. This could lead to local denial of service if a malicious actor has alreaCVE-2026-20448.8GIMP PGM File Parsing Uninitialized Memory Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrCVE-2026-204406.7In MAE, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicio
CVE-2026-2043: High severity, CVSS 8.8 | Vulnix