LibreNMS Patches Multiple RCE and SSRF Flaws
LibreNMS versions before 26.5.0 contain multiple vulnerabilities enabling remote code execution, SSRF, and XSS.
ANSSI-CERT-FR published an advisory covering multiple vulnerabilities in LibreNMS, an open-source network monitoring platform, affecting all versions prior to 26.5.0. The flaws allow attackers to achieve remote code execution, perform server-side request forgery (SSRF), and inject indirect remote cross-site scripting (XSS) attacks. These issues were disclosed via seven separate GitHub security advisories on August 4, 2026, and tracked under CVE-2026-45694.
No evidence of active exploitation is mentioned in the advisory. Administrators running LibreNMS should apply the vendor's patches by upgrading to version 26.5.0 or later as referenced in the official security bulletins.
Mentioned in this report
Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0966
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free