CVE-2019-20197: Nagios XI

High severity, CVSS 8.8. EPSS: 22.4% chance of exploitation in the next 30 days.

In Nagios XI 5.6.9, an authenticated user is able to execute arbitrary OS commands via shell metacharacters in the id parameter to schedulereport.php, in the context of the web-server user account.

Affected products

• Nagios Nagios XI: version 5.6.9 only

Published 2019-12-31. Last modified 2026-06-17.