Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.4
CVE-2026-84190: LibreNMS lets admin run malicious code
CVE-2026-84190 · published 1 month ago
Summary
If you use LibreNMS version earlier than 26.5.0, an administrator can change a setting to point to a harmful program and cause it to run simply by visiting a specific web page. This could let the attacker execute any command on the server. Upgrade LibreNMS to version 26.5.0 or newer to close the risk.
What to do
- Update librenms librenms to version 26.5.0.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| composer | librenms | librenms |
< 26.5.0 Fix: upgrade to 26.5.0
|
Original advisory text
LibreNMS before 26.5.0 Remote Code Execution via AboutController
LibreNMS versions before 26.5.0 contain a remote code execution vulnerability in the AboutController where the snmpget configuration parameter is passed to shell_exec() without proper validation. An authenticated administrator can modify the snmpget configuration to point to a malicious executable file and trigger code execution by accessing the /about endpoint.
References
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/84xxx/CVE-2026-84190... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-84190 Vendor Advisory
- https://www.vulncheck.com/advisories/librenms-before-26.5.0-remote-code-executio... Vendor Advisory
- https://github.com/librenms/librenms/security/advisories/GHSA-jf24-8g2h-2wg7 Vendor Advisory
- https://github.com/librenms/librenms/releases/tag/26.5.0
- https://github.com/advisories/GHSA-jf24-8g2h-2wg7
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Severity
9.4
Critical
Type
CWE-77Command Injection
CWE-78OS Command Injection
Timeline
Published1 Sep 2026
Updated3 Sep 2026
First seen18 Aug 2026
Track software like this
Free during beta