CVE-2026-109352 librenms CVE debrief

Who should care

Defenders responsible for LibreNMS installations, particularly those with wireless sensor configurations, should assess exposure and prioritize verification and updates. This includes reviewing configurations, monitoring for suspicious activity, and ensuring timely updates to prevent exploitation. Security teams and vulnerability management teams should also be aware of the potential risks and take appropriate measures.

Why it matters

CVE-2026-109352 is a stored cross-site scripting vulnerability in LibreNMS before 26.9.0 that allows attackers to execute malicious JavaScript, enabling session hijacking. Defenders should prioritize verification and updates, and monitor wireless sensor configurations.

• Session hijacking via malicious JavaScript execution
• Potential for attackers to gain unauthorized access to user sessions
• Need for defenders to verify and update LibreNMS installations
• Importance of monitoring wireless sensor configurations for suspicious activity

Technical summary

The vulnerability is located in the includes/html/pages/device/wireless.inc.php file of LibreNMS before 26.9.0. It allows attackers controlling a monitored device's SNMP agent to set malicious JavaScript values, such as AI-AP-MIB::aiSSID, which execute when authenticated users view the device's Wireless tab, enabling session hijacking. This issue arises from the lack of proper escaping of user-supplied input. The vulnerability can be exploited by setting malicious values via SNMP, which are then stored and executed as part of the device's Wireless tab.

Defensive priority

Defenders should prioritize verifying and updating LibreNMS installations to version 26.9.0 or later, and review wireless sensor configurations for potential malicious modifications.

Recommended defensive actions

• Verify and update LibreNMS installations to version 26.9.0 or later
• Review wireless sensor configurations for potential malicious modifications
• Monitor for suspicious activity on the Wireless tab
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance

Evidence notes

The CVE record and source item provide details on the vulnerability, including its location in the wireless.inc.php file and the potential impact of session hijacking. The vulnerability is located in the includes/html/pages/device/wireless.inc.php file of LibreNMS before 26.9.0. Attackers controlling a monitored device's SNMP agent can set values such as AI-AP-MIB::aiSSID to malicious JavaScript that executes when authenticated users view the device's Wireless tab, enabling session hijacking. Evidence is limited to public CVE Program,

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.