CVE-2026-80214CWE-78command-injection

CVE-2026-80214

published August 26, 2026

CVSS
8.6
EPSS
1%
Percentile
44.6
In the wild
Unconfirmed
What it is

LibreNMS’s Virtualization Discovery module is vulnerable to command line injection. An authenticated admin user can execute arbitrary code on the host server.

The record
Technical detail
CVSS
8.6 · NONE
CVSS v4.0
8.6 · CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N
EPSS
0.00539 · 44.6th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2026-08-26T09:18Z
References (3)
https://github.com/librenms/librenms/security/advisories/GHSA-7hmq-j399-mqwf · ab69c47f-b95e-4bf2-b2d9-4b1fd1b24b4ahttps://projectblack.io/blog/librenms-authenticated-rce-26-5-0/#rce-by-command-line-injection-2641 · ab69c47f-b95e-4bf2-b2d9-4b1fd1b24b4ahttps://github.com/librenms/librenms/security/advisories/GHSA-7hmq-j399-mqwf · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 27 AUG 06:47Z
    EPSS moved — → 0%
    epss
  • 26 AUG 02:11Z
    LibreNMS Virtualisation Discovery Module RCE
    cvelistv5