CVE-2026-84193: Librenms

Medium severity, CVSS 5.8. EPSS: 0.3% chance of exploitation in the next 30 days.

LibreNMS through 26.2.0 contains a stored cross-site scripting vulnerability in legacy PHP template pages that render unescaped SNMP-sourced data fields including BGP peer descriptions, VRF names, process information, and SLA tags. Attackers with device management access or network access to enroll a rogue SNMP device can inject malicious JavaScript that executes when admins view affected routing and device pages, enabling credential theft and CSRF token exfiltration.

Affected products

• Librenms Librenms: up to and including 26.2.0

Published 2026-09-01. Last modified 2026-09-08.