Loading story…
A chain of vulnerabilities in Nagios XI 5.5.10 allowed a remote attacker to gain a root shell by combining a reflected cross-site scripting flaw, an authenticated remote code execution bug, and a local privilege escalation issue. The attack began with a malicious URL targeting the xiwindow parameter; if an authenticated Nagios XI user with autodiscovery job creation privileges visited the link, the attacker could execute commands as apache:nagios through command injection in autodiscovery job handling via the system_dns parameter.
The final step abused the root-runnable repair_databases.sh script, which evaluated PHP-derived output from a writable configuration file, enabling escalation from the web server context to full root access. The issues were assigned CVE-2019-9164, CVE-2019-9166, and CVE-2019-9167, and Nagios released Nagios XI 5.5.11 to address the initial reported flaw as part of its security disclosures.
Get the actors, campaigns, and ATT&CK mapping behind it.
2 events from the most recent confirmed update back to the earliest known activity.
The disclosed Nagios XI 5.5.10 issues were assigned CVE-2019-9164, CVE-2019-9166, and CVE-2019-9167. The vulnerabilities covered reflected XSS, authenticated RCE, and local privilege escalation components of the attack chain.
Shielder's disclosure states that Nagios released Nagios XI 5.5.11 to address the first reported issue in a vulnerability chain affecting Nagios XI 5.5.10. The chain included reflected XSS, authenticated remote code execution, and local privilege escalation that could lead to root shell access.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**CVE-2023-29489** is a reflected, pre-authentication cross-site scripting flaw in cPanel’s default web-hosting control-panel configuration. Crafted requests to the `/cpanelwebcall/` path could execute arbitrary JavaScript in a victim’s browser because Apache proxies that directory to cPanel management ports, including when the request reaches the server through ports 80 or 443. An attacker could use the flaw to steal or hijack an authenticated cPanel session and, through the victim’s privileges, upload a web shell for potential command execution on the hosted server. cPanel fixed the issue in versions `11.109.9999.116`, `11.108.0.13`, `11.106.0.18`, and `11.102.0.31`; affected administrators should ensure their deployments are updated to a remediated release.
Sep 3, 2026
Rapid7 submitted a Metasploit module for **Ivanti Connect Secure** that targets the chained vulnerabilities `CVE-2023-46805` and `CVE-2024-21887`, a combination widely associated with remote code execution on exposed appliances. The pull request indicates offensive security tooling has been updated to support exploitation of the authentication bypass and command injection chain, lowering the barrier for defenders and attackers alike to reproduce the issue in testing or live environments. A separate GitHub reference shows ProjectDiscovery adding a Nuclei template for `CVE-2025-4665`, identified as a **SQL injection** flaw in the **WordPress CFDB7** plugin. While the available material does not include exploitation details or patch guidance, both references show public security tooling rapidly incorporating newly disclosed vulnerabilities, increasing the urgency for organizations to identify exposed Ivanti gateways and vulnerable WordPress installations and apply mitigations or updates.
Jun 29, 2026
Public advisories disclosed two **critical pre-authentication remote code execution** vulnerabilities in **Xeams 10.3 build 6449** from Synametrics Technologies, both of which can reportedly deliver **`uid=0(root)`** on default deployments. One attack chain abuses the SMTP rules engine’s `X-SM_SAVE_BODY_4DEBUGGING` debug write behavior to place attacker-controlled files at arbitrary paths; when Xeams runs as root, the write primitive can be leveraged through cron to achieve unauthenticated root command execution. A second flaw leaves **`SQLRunner.jsp`** exposed without authentication and combines that access with **hardcoded Apache Derby credentials** to let attackers run arbitrary SQL and write a **JSP webshell** to the server. The published reports said both exploit paths were verified end to end, giving attackers full control of the mail server and potential access to the Xeams mail repository, sharply increasing the risk of mailbox compromise, persistence, and broader server takeover.
Aug 6, 2026