High severity · published Apr 13, 2026
CVE-2026-6204
LibreNMS versions before 26.3.0 are affected by an authenticated remote code execution vulnerability by abusing the Binary Locations config and the Netcommand feature
7.2
CVSS
7.5%
EPSS
No
On KEV
Description
LibreNMS versions before 26.3.0 are affected by an authenticated remote code execution vulnerability by abusing the Binary Locations config and the Netcommand feature. Successful exploitation requires administrative privileges. Exploitation could result in compromise of the underlying web server.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)7.5% · higher than 94% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LI
librenms · librenms
before 26.3.0 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-6204
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-6204
Third Party Advisory
https://github.com/librenms/librenms/security/advisories/GHSA-pr3g-phhr-h8fh
Exploit
https://projectblack.io/blog/librenms-authenticated-rce-and-xss/#binary-path-rce-poc
More from librenms
9.8
CVE-2026-86426
LibreNMS before 26.8.0 Authentication Bypass via API Token Type Confusion
9.8
CVE-2022-4070
Insufficient Session Expiration in GitHub repository librenms/librenms prior to 22.10.0
9.8
CVE-2022-29712
LibreNMS v22.3.0 was discovered to contain multiple command injection vulnerabilities via the service_ip, hostname, and service_param parameters
9.8
CVE-2021-44278
Librenms 21.11.0 is affected by a path manipulation vulnerability in includes/html/pages/device/showconfig.inc.php
9.8
CVE-2019-10665
An issue was discovered in LibreNMS through 1.47