CVE-2026-109355 librenms CVE debrief

Who should care

Defenders responsible for LibreNMS instances, particularly those using the Tools Oxidized Node List, should assess exposure and prioritize verification and remediation. This includes reviewing system logs for suspicious activity, verifying the Tools Oxidized Node List for potential script injection, and updating affected systems to version 26.9.0 or later. Security teams and vulnerability management teams should also prioritize verification and remediation

Why it matters

Defenders should prioritize verifying and updating LibreNMS instances to version 26.9.0 or later, and review the Tools Oxidized Node List for potential script injection, as attackers may exploit this vulnerability to inject script that executes in browsers of users viewing the Tools Oxidized page.

• Potential script injection in the Tools Oxidized page
• Possible exploitation by attackers controlling the Oxidized response or a device's SNMP sysName
• Verification priority for LibreNMS instances prior to version 26.9.0

Technical summary

The vulnerability exists in the get_oxidized_nodes_list() function of LibreNMS, which renders Oxidized API fields and SNMP sysName unescaped, allowing attackers to inject script that executes in browsers of users viewing the Tools Oxidized page. This stored cross-site scripting vulnerability impacts LibreNMS instances prior to version 26.9.0. Defenders should prioritize verifying and updating affected systems to prevent potential script injection attacks. The vulnerability allows attackers controlling the Oxidized response or a device's SNMP sysName to inject malicious script.

Defensive priority

Defenders should prioritize verifying and updating LibreNMS instances to version 26.9.0 or later, and review the Tools Oxidized Node List for potential script injection.

Recommended defensive actions

• Verify and update LibreNMS instances to version 26.9.0 or later
• Review the Tools Oxidized Node List for potential script injection
• Monitor for suspicious activity on the Tools Oxidized page
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and source item provide details on the vulnerability, but limited information is available on potential exploitation or affected systems. Defenders should verify the Tools Oxidized Node List for potential script injection and review system logs for suspicious activity. The vulnerability exists in the get_oxidized_nodes_list() function, which renders Oxidized API fields and SNMP sysName unescaped. Evidence is limited, and further verification is necessary to determine the full scope of the vulnerability.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.