# LibreNMS remote code execution vulnerability

Published: 2026-06-11 · Severity: routine · Sectors: technology, infrastructure
Canonical: https://vorant.io/reports/a7820c61-d511-51b4-b8ee-158d33a1b67d/librenms-remote-code-execution-vulnerability

> Remote code execution vulnerability in LibreNMS 21.6.x through 26.x requires patching to 26.5.0 or later.

A remote code execution vulnerability has been discovered in LibreNMS affecting versions 21.6.x through 26.x prior to 26.5.0. The vulnerability allows an attacker to execute arbitrary code on affected systems. LibreNMS is a widely-deployed open-source network monitoring and management platform. Organisations running vulnerable versions should apply patches immediately as RCE vulnerabilities in network management tools pose significant risk to infrastructure monitoring and control systems. The vendor has issued security guidance and patches addressing this issue.

## Detection guidance (public sample)

### Web Server or PHP Process Spawning Shell With Download or Reverse-Shell Commands

ATT&CK: T1190

Detects a PHP or web server process (as used by LibreNMS) spawning a shell that runs download, reverse-shell or encoded-payload commands. This is a typical post-exploitation pattern after RCE in a PHP web application. The report gives no exploit specifics, so this rule covers generic RCE follow-on behaviour. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Web Server or PHP Process Spawning Shell With Download or Reverse-Shell Commands
description: Detects PHP-FPM, PHP, Apache, or Nginx parent processes spawning a shell
  that runs download-and-execute, reverse-shell, or encoded-payload commands. Typical
  post-exploitation behaviour after RCE in a PHP web application such as LibreNMS.
  Does not depend on a specific exploit path or payload.
tags:
- attack.initial-access
- attack.t1190
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|contains:
    - php-fpm
    - /apache2
    - /httpd
    - /nginx
    ParentImage|endswith:
    - /php
  selection_parent_php:
    ParentImage|endswith: /php
  selection_shell:
    Image|endswith:
    - /sh
    - /bash
    - /dash
  selection_cmd:
    CommandLine|contains:
    - curl
    - wget
    - /dev/tcp/
    - nc -e
    - bash -i
    - base64 -d
    - python -c
    - perl -e
    - mkfifo
  condition: (selection_parent or selection_parent_php) and selection_shell and selection_cmd
falsepositives:
- Administrators running LibreNMS custom alert transports or scripts that call curl
  or wget through a shell from PHP
- Web application update or installer scripts that download files via a shell
level: medium
id: ba91e352-27b9-5d5a-b55e-f9f2abcae45f
status: experimental
author: Vorant
references:
- https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0732
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0732

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/a7820c61-d511-51b4-b8ee-158d33a1b67d/librenms-remote-code-execution-vulnerability.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup