CVE-2026-84194 librenms CVE debrief

Who should care

System administrators and security teams responsible for LibreNMS installations, particularly those with libvirt support enabled, should review and apply patches or upgrades. Affected operators and platforms require immediate attention to prevent potential remote code execution. Vulnerability management and security teams should prioritize patching and monitor for suspicious activity in discovery worker context. Asset inventory review is also recommended to identify potentially affected systems. Security teams should track exceptions and retest remediated assets to ensure the vulnerability is properly addressed. Additionally, security teams should verify that device hostnames are properly sanitized and that libvirt discovery features are restricted to authorized personnel. Security teams should also consider implementing compensating controls for exposed systems while remediation is scheduled and verified. Finally, security teams should review relevant monitoring, detection, and logs for exposed assets that need extra review. This should be done in the context of the organization's specific security policies and procedures. The goal is to minimize potential damage and ensure the security of the system. The security team should also consider the potential operational impact of the vulnerability and plan accordingly. The security team should also review the CVE record and vendor guidance to validate affected scope, severity, and recommended actions. The security team should assign an owner for follow-up and track the status of remediation efforts. The security team should also consider implementing source tracking to monitor for potential exploitation attempts. The security team should also review and update their incident response plan to include procedures for responding to potential exploitation of this vulnerability. The security team should also consider providing additional training to personnel on the vulnerability and its potential impact. The security team should also review and update their vulnerability management procedures to ensure that similar vulnerabilities are addressed in a timely manner. The security team should also consider implementing asset

Technical summary

The vulnerability exists in VminfoLibvirt.php where the device hostname is concatenated into shell commands without proper escaping, allowing an authenticated admin to inject arbitrary OS commands. This leads to remote code execution in the discovery worker context. The affected product context is LibreNMS with libvirt support enabled. Defensive impact is high due to the requirement for an authenticated admin.

Defensive priority

High-priority patching recommended due to authenticated admin exploitation leading to remote code execution.

Recommended defensive actions

• Apply patches or upgrade to LibreNMS version 26.4.0 or later
• Restrict access to libvirt discovery features for authenticated admins
• Monitor for suspicious activity in discovery worker context
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

LibreNMS versions >= 23.10.0 and < 26.2.0 contain an authenticated OS command injection vulnerability in libvirt discovery. Evidence from official CVE Program record and NIST NVD detail page supports the existence of an authenticated OS command injection vulnerability. The vulnerability requires an authenticated admin to set a crafted device hostname. Defenders should verify libvirt support is disabled or updated to version 26.4.0 or later. Additional verification of device hostnames and libvirt discovery features is recommended.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.