CVE-2026-84192

LibreNMS before 26.3.1 is vulnerable to stored cross-site scripting (CWE-79) in legacy PHP templates that render SNMP-sourced and syslog-sourced data without HTML escaping. An attacker who controls any monitored network device can inject arbitrary JavaScript through SNMP interface descriptions or syslog program fields, and the payload executes whenever an authenticated user views the affected pages. A successful attack can expose the victim's browser session to the attacker, enabling session/credential theft and actions taken as that user (high confidentiality impact, low integrity impact per the CVSS 4.0 score). Any organization running LibreNMS before 26.3.1 that monitors third-party or attacker-reachable devices is affected, particularly sites that accept syslog from broad or untrusted sources. No exploitation has been reported: there is no public proof-of-concept, the flaw is not in CISA KEV, and EPSS estimates only a 0.2% probability of exploitation within 30 days.

What to do: Upgrade LibreNMS to version 26.3.1 or later, which escapes the affected template output. As interim mitigation, restrict who can set SNMP interface descriptions on monitored devices and limit accepted syslog sources to trusted senders, since only devices the attacker controls or whose syslog you ingest can be used to plant payloads. After patching, review interface descriptions and syslog program values on monitored devices for unexpected or suspicious content that may have been used to stage scripts.