Is CVE-2026-84193 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-84193 being exploited in the wild.

How severe is CVE-2026-84193?

Informational severity, with a CVSS score of 5.8, published 1 September 2026.

Is there a fix for CVE-2026-84193?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-84193 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-84193?

Check whether you run Librenms at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-84193: LibreNMS stored cross-site scripting in SNMP data

CVE-2026-84193 · Severity: info · CVSS 5.8 · Published 2026-09-01

LibreNMS is a network monitoring platform that collects and displays device information including routing, process, and service metrics. A stored cross-site scripting vulnerability allows attackers with device management access or ability to enroll a rogue SNMP device to inject malicious JavaScript that executes when administrators view affected pages, enabling theft of SNMP credentials and administrative session tokens.

Technologies: Librenms. Vendors: Librenms.

Quick answers

Is CVE-2026-84193 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-84193 being exploited in the wild.
How severe is CVE-2026-84193?: Informational severity, with a CVSS score of 5.8, published 1 September 2026.
Which products and versions are affected?: Librenms through 26.2.0.
Is there a fix for CVE-2026-84193?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-84193 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-84193?: Check whether you run Librenms at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This is a stored cross-site scripting (XSS) vulnerability in legacy PHP template pages that render SNMP-sourced data without HTML escaping. Affected fields include BGP peer descriptions, VRF names, process information, and SLA tags across multiple pages (routing/bgp.inc.php, routing/vrf.inc.php, device/processes.inc.php, device/slas.inc.php). The root cause is the use of raw echo statements without htmlspecialchars() or htmlentities() in legacy PHP templates that predate the migration to Laravel Blade. An attacker with device management privileges or network access to place a rogue SNMP device can inject crafted SNMP values; when any administrator views affected pages, the JavaScript executes in their browser context. Exploitation allows exfiltration of SNMP community strings and CSRF tokens (XSRF-TOKEN is not httponly), or performing authenticated actions via fetch() with the admin's session. The attack requires high privilege prerequisites (device management access or network positioning) and user interaction (admin must view the affected page). No patched versions have been released as of the advisory date.

Affected products

LibreNMS LibreNMS through 26.2.0

Timeline

2026-08-04: disclosed: GitHub Security Advisory GHSA-v5jp-f342-234h published
2026-09-01: advisory: CVE-2026-84193 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.