What is the CVSS score of CVE-2026-26988?

CVE-2026-26988 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of PHP are affected by CVE-2026-26988?

LibreNMS network monitoring instances running version 25.12.0 or earlier are vulnerable to SQL injection attacks that could allow unauthorized database access, data theft, or system compromise.. A patch is available.

Is there a public PoC exploit available for CVE-2026-26988?

Yes, a public proof-of-concept exploit is available for CVE-2026-26988. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-26988?

Within 24 hours: Identify and inventory all LibreNMS instances and their versions; isolate or restrict network access to affected instances if patching cannot be completed immediately. Within 7 days: Apply vendor patches to upgrade all LibreNMS deployments to version 25.12.1 or later; validate patches in test environment first. Within 30 days: Conduct security audit of database access logs for signs of exploitation; review and strengthen authentication and access controls for monitoring infrastructure.

PHP CVE-2026-26988

CRITICAL

SQL Injection (CWE-89)

2026-02-20 security-advisories@github.com

GHSA-h3rv-q4rq-pqcv

PHP MySQL SNMP SQLi Librenms

9.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:04 vuln.today

PoC Detected

Feb 20, 2026 - 16:31 vuln.today

Public exploit code

Patch released

Feb 20, 2026 - 16:31 nvd

Patch available

CVE Published

Feb 20, 2026 - 02:16 nvd

CRITICAL 9.1

DescriptionGitHub Advisory

LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Versions 25.12.0 and below contain an SQL Injection vulnerability in the ajax_table.php endpoint. The application fails to properly sanitize or parameterize user input when processing IPv6 address searches. Specifically, the address parameter is split into an address and a prefix, and the prefix portion is directly concatenated into the SQL query string without validation. This allows an attacker to inject arbitrary SQL commands, potentially leading to unauthorized data access or database manipulation. This issue has been fixed in version 26.2.0.