CVE-2026-84190

LibreNMS versions before 26.5.0 contain a remote code execution vulnerability in the AboutController where the snmpget configuration parameter is passed to shell_exec() without proper validation. An authenticated administrator can modify the snmpget configuration to point to a malicious executable file and trigger code execution by accessing the /about endpoint.

  • Published Sep 1, 2026
  • CVSS 8.7 high
  • 0.9% chance of exploitation in the next 30 days (EPSS)
  • A fix is available

Affected software

CVE-2026-84190 at the National Vulnerability Database