CVE-2026-80214: LibreNMS Virtualisation Discovery Module RCE

Severity: high (CVSS 8.6 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-26 · updated 2026-09-09
Weakness: CWE-78

Description

LibreNMS’s Virtualization Discovery module is vulnerable to command line injection. An authenticated admin user can execute arbitrary code on the host server.

Affected products

librenms: from 23.10.0 before 26.4.1 — fixed in 26.4.1

How to fix

Upgrade to a fixed version: librenms 26.4.1. Check the vendor advisory for mitigations.

References

https://github.com/librenms/librenms/security/advisories/GHSA-7hmq-j399-mqwf
https://projectblack.io/blog/librenms-authenticated-rce-26-5-0/#rce-by-command-line-injection-2641
https://github.com/librenms/librenms/security/advisories/GHSA-7hmq-j399-mqwf

Get alerted when CVE-2026-80214 or the next vulnerability affects your stack