Quick answers
- Is CVE-2026-109356 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-109356 being exploited in the wild.
- How severe is CVE-2026-109356?
- Medium severity, with a CVSS score of 4.3, published 12 October 2026.
- Which products and versions are affected?
- Librenms before 26.9.0.
- Is there a fix for CVE-2026-109356?
- Yes: fixed in 26.9.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-109356 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-109356?
- Check whether you run Librenms at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: 26.9.0
Technical details
PortsController::purge uses Port::hasAccess() as a visibility scope filter rather than checking for explicit delete capability, allowing authenticated users with only read privileges (view/viewAll) to issue DELETE requests to /ports/purge and physically remove port entries from the database. The vulnerability is amplifiable via the purge=all parameter, which deletes every soft-deleted port on all visible devices. A fix requires an explicit capability check (port.delete) in addition to the visibility scope check.
Affected products
- LibreNMS LibreNMS before 26.9.0
Timeline
- 2026-09-23: disclosed
- 2026-10-12: advisory