Is CVE-2026-84188 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-84188 being exploited in the wild.

How severe is CVE-2026-84188?

Medium severity, with a CVSS score of 4.8, published 1 September 2026.

Which products and versions are affected?

Librenms <=26.4.0; librenms/librenms (Packagist) ECOSYSTEM:introduced=0,fixed=26.7.0.

Is there a fix for CVE-2026-84188?

Yes. librenms/librenms (Packagist): upgrade to 26.7.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-84188 attacked?

It is attacked over the network.

Am I affected by CVE-2026-84188?

Check whether you run Librenms or librenms/librenms (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-84188: LibreNMS stored cross-site scripting in graph description settings

Q: Which products and versions are affected?

Librenms <=26.4.0; librenms/librenms (Packagist) ECOSYSTEM:introduced=0,fixed=26.7.0.

Q: Is there a fix for CVE-2026-84188?

Yes. librenms/librenms (Packagist): upgrade to 26.7.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-84188 attacked?

It is attacked over the network.

Q: Am I affected by CVE-2026-84188?

Check whether you run Librenms or librenms/librenms (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-84188 · Severity: medium · CVSS 4.8 · Published 2026-09-01

LibreNMS is a network monitoring and graphing platform used by organizations to track infrastructure performance. A vulnerability allows administrators to inject malicious HTML code into graph description configuration settings, which then executes in the browsers of all authenticated users viewing those graphs. This could lead to session hijacking, credential theft, or other unauthorized actions performed on behalf of legitimate users.

Technologies: Librenms, librenms/librenms (Packagist). Vendors: Librenms, Packagist.

Quick answers

Is CVE-2026-84188 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-84188 being exploited in the wild.
How severe is CVE-2026-84188?: Medium severity, with a CVSS score of 4.8, published 1 September 2026.
Which products and versions are affected?: Librenms <=26.4.0; librenms/librenms (Packagist) ECOSYSTEM:introduced=0,fixed=26.7.0.
Is there a fix for CVE-2026-84188?: Yes. librenms/librenms (Packagist): upgrade to 26.7.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-84188 attacked?: It is attacked over the network.
Am I affected by CVE-2026-84188?: Check whether you run Librenms or librenms/librenms (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

librenms/librenms (Packagist): upgrade to 26.7.0 or later
```
composer require librenms/librenms:^26.7.0
```

Technical details

LibreNMS contains a stored cross-site scripting (XSS) vulnerability in the graph_descr.<graphtype> configuration settings. The vulnerable code in includes/html/pages/graphs.inc.php echoes the configuration value directly without HTML entity escaping using htmlspecialchars(). An authenticated administrator can store a malicious HTML/JavaScript payload via a PUT request to /settings/graph_descr.<graphtype>. When any authenticated user views the affected graph type, the payload executes in their browser with the privileges of that user. The vulnerability requires administrative privileges to inject the payload and user interaction (visiting the affected graph), but affects the security scope of all authenticated users. The fix, available in version 26.7.0, applies htmlspecialchars() with ENT_QUOTES encoding to neutralize the payload.

Affected products

LibreNMS LibreNMS <=26.4.0

Identifiers

CVE-2026-84188
GHSA-7cj5-v4pp-v632

Timeline

2026-09-01: disclosed
2026: patched: Version 26.7.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.