The CVSS 6.1 on this CVE will cause you to under-prioritize it. Don't.
The reflected XSS lives in cmd.cgi — the command submission interface where Nagios administrators dispatch operational commands to every system they monitor. That's architecturally distinct from XSS in a settings page or status display. When you steal a session from cmd.cgi, you're not just getting a cookie; you're getting a session that likely holds stored SSH keys, API tokens, or credentials for the entire infrastructure Nagios touches. Most Nagios deployments rotate these credentials rarely, if ever — a stolen admin session in this context is a skeleton key to everything Nagios monitors.
The EPSS score of 0.00266 reinforces this analysis. Low EPSS on command-interface XSS in infrastructure software typically signals that threat actors are being surgical rather than noisy. The authenticated-user requirement doesn't weaken the CVE — it narrows the attacker pool to those running spear-phishes or compromising credentials stores, which is exactly the threat profile of actors who can cause infrastructure-level damage. Mass scanners ignore it because the prerequisite filters out opportunistic exploitation.
The NagFormId parameter that drives this XSS is worth understanding: it's form state management, not arbitrary user input. It exists to track which submission form was dispatched so the confirmation page can echo it back. This is the 'internal parameter reflection' bug class — developers reflecting their own state-machine parameters because the boundary between 'what we generate' and 'what the client echoes back' gets treated as a trusted internal channel. Security hardening stops at the visible seams (authentication, CSRF); the plumbing layer where internal state gets reflected without sanitization is where these survive.
What you should verify: can JavaScript executed in cmd.cgi trigger Nagios commands (host checks, service restarts) via the victim's authenticated session without exfiltrating the cookie? If the answer is yes, this isn't a stepping-stone vulnerability — it's a one-click operational compromise. Also check whether your Nagios deployment exposes cmd.cgi to the internet and whether the admin session tokens have ever been rotated. The combination of command-interface access, stored infrastructure credentials, and this being an 'internal parameter reflection' bug (a class that evades automated scanners) creates an exposure window that the CVSS and EPSS scores dramatically understate.
Patch both Nagios Core (pre-4.5.14) and XI (pre-2026R1.7).