What’s Vulnerable › Vulnerabilities

CVE-2024-14009: Nagios XI < 2024R1.0.1 Privilege Escalation via System Profile

• Severity: high (CVSS 7.2 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-10-30 · updated 2026-10-02
• Weakness: CWE-269

Description

Nagios XI versions prior to 2024R1.0.1 contain a privilege escalation vulnerability in the System Profile component. The System Profile feature is an administrative diagnostic/configuration capability. Due to improper access controls and unsafe handling of exported/imported profile data and operations, an authenticated administrator could exploit this vulnerability to execute actions on the underlying XI host outside the application's security scope. Successful exploitation may allow an administrator to obtain root privileges on the XI server.

Affected products

• Nagios XI: before 2024; 2024-r1 — fixed in 2024

How to fix

Upgrade to a fixed version: Nagios XI 2024. Check the vendor advisory for mitigations.

References

• https://www.nagios.com/changelog/nagios-xi/
• https://www.nagios.com/products/security/#nagios-xi
• https://www.vulncheck.com/advisories/nagios-xi-privilege-escalation-via-system-profile

Get alerted when CVE-2024-14009 or the next vulnerability affects your stack