Is CVE-2026-84192 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-84192 being exploited in the wild.

How severe is CVE-2026-84192?

High severity, with a CVSS score of 7.1, published 1 September 2026.

Which products and versions are affected?

Librenms before 26.3.1; librenms/librenms (Packagist) ECOSYSTEM:introduced=0,fixed=26.5.0.

Is there a fix for CVE-2026-84192?

Yes. librenms/librenms (Packagist): upgrade to 26.5.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-84192 attacked?

It is attacked over the network.

Am I affected by CVE-2026-84192?

Check whether you run Librenms or librenms/librenms (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-84192: LibreNMS stored cross-site scripting in legacy PHP templates

CVE-2026-84192 · Severity: high · CVSS 7.1 · Published 2026-09-01

LibreNMS is a network monitoring platform that polls network devices via SNMP and collects syslog messages. Legacy PHP template files in LibreNMS fail to escape SNMP-sourced data (interface descriptions, sensor names) and syslog program fields before displaying them to authenticated users. An attacker controlling a monitored network device can inject malicious JavaScript that steals session cookies or performs unauthorized actions when any authenticated user views affected pages (alerts, health dashboards, syslog viewer).

Technologies: Librenms, librenms/librenms (Packagist). Vendors: Librenms, Packagist.

Quick answers

Is CVE-2026-84192 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-84192 being exploited in the wild.
How severe is CVE-2026-84192?: High severity, with a CVSS score of 7.1, published 1 September 2026.
Which products and versions are affected?: Librenms before 26.3.1; librenms/librenms (Packagist) ECOSYSTEM:introduced=0,fixed=26.5.0.
Is there a fix for CVE-2026-84192?: Yes. librenms/librenms (Packagist): upgrade to 26.5.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-84192 attacked?: It is attacked over the network.
Am I affected by CVE-2026-84192?: Check whether you run Librenms or librenms/librenms (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

librenms/librenms (Packagist): upgrade to 26.5.0 or later
```
composer require librenms/librenms:^26.5.0
```

Technical details

LibreNMS stores network device telemetry (interface descriptions, memory pool descriptions, sensor names from SNMP) and syslog messages in a database. Multiple legacy PHP template files (print-syslog.inc.php, functions.inc.php, health pages, pseudowires.inc.php, vrf.inc.php) output these values directly into HTML without HTML-entity encoding. The vulnerability is stored XSS: an attacker controlling a monitored SNMP device or syslog source can embed JavaScript payloads in interface descriptions or syslog program fields. When any authenticated LibreNMS user views affected pages (alerts, health dashboards, syslog viewer), the JavaScript executes in their browser with access to their session credentials. Newer Blade templates properly escape output; the issue is confined to legacy includes/html/ PHP files. Patch: upgrade to version 26.3.1 or later.

Affected products

LibreNMS LibreNMS before 26.3.1

Identifiers

CVE-2026-84192
GHSA-7w8c-qgxg-m7jx

Timeline

2026-09-01: disclosed
2026-06-15: advisory: GitHub Security Advisory GHSA-7w8c-qgxg-m7jx published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.