CVE-2014-8994: The check_diskio plugin 3.2.6 and earlier for Nagios and Icinga allows local users to write to arbitrary fi...

Security readout for executives and security teams

CVE-2014-8994 affects the check_diskio monitoring plugin used with Nagios and Icinga. A local user could abuse a predictable temporary file name to make the plugin write where it should not. Business risk is mainly on monitoring servers with local user access, especially if the plugin runs with elevated permissions. Exposure is likely limited to systems running check_diskio 3.2.6 or earlier for Nagios or Icinga, where untrusted local users can access the relevant temporary-file location. Treat this as a targeted hardening item, not an internet-scale emergency. Prioritize monitoring servers with multiple local users, shared administration, or plugins running with privileged permissions. Mitigation focus: Inventory Nagios and Icinga hosts for check_diskio usage.; Check vendor or maintainer guidance for a corrected version or replacement.; Remove the plugin where it is no longer required..

Prepared

Jun 14, 2026, 06:22 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.