Is CVE-2026-80214 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-80214 being exploited in the wild.

How severe is CVE-2026-80214?

Informational severity, with a CVSS score of 8.8, published 26 August 2026.

Which products and versions are affected?

Librenms 23.10.0 through 26.4.0.

Is there a fix for CVE-2026-80214?

A patch was published on 2026-04-01: Fix released in LibreNMS 26.4.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-80214 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-80214?

Check whether you run Librenms at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-80214: LibreNMS command injection in Virtualization Discovery module

CVE-2026-80214 · Severity: info · CVSS 8.8 · Published 2026-08-26

LibreNMS is an open-source network monitoring platform used by organizations to track infrastructure and device health. An authenticated administrator can inject arbitrary shell commands into virtualization discovery settings, leading to remote code execution on the monitoring server. An attacker with admin access can compromise the entire monitoring infrastructure and potentially pivot to other systems on the network.

Technologies: Librenms. Vendors: Librenms.

Quick answers

Is CVE-2026-80214 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-80214 being exploited in the wild.
How severe is CVE-2026-80214?: Informational severity, with a CVSS score of 8.8, published 26 August 2026.
Which products and versions are affected?: Librenms 23.10.0 through 26.4.0.
Is there a fix for CVE-2026-80214?: A patch was published on 2026-04-01: Fix released in LibreNMS 26.4.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-80214 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-80214?: Check whether you run Librenms at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a command-line injection flaw in LibreNMS/OS/Traits/VminfoLibvirt.php where user input from the web UI (Libvirt Username and Libvirt Protocols fields) is concatenated directly into exec() calls without sanitization. An authenticated administrator can inject shell metacharacters (e.g., semicolons) to execute arbitrary commands that run with the privileges of the LibreNMS poller process (typically the 'librenms' system user). Additionally, the application fails to validate binary paths, allowing an attacker to substitute the virsh executable path with other binaries (like wget or bash) to achieve code execution or arbitrary file write. Commands are executed automatically during scheduled discovery jobs or can be triggered manually via CLI, making exploitation reliable and difficult to detect.

Affected products

LibreNMS LibreNMS 23.10.0 through 26.4.0

Timeline

2026-08-04: disclosed: GitHub security advisory GHSA-7hmq-j399-mqwf published by maintainer
2026-08-26: advisory: CVE-2026-80214 published to NVD
2026-04-01: patched: Fix released in LibreNMS 26.4.1

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.