What is the CVSS score of CVE-2026-26990?

CVE-2026-26990 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of PHP are affected by CVE-2026-26990?

LibreNMS instances running version 25.12.0 or earlier are vulnerable to SQL injection attacks that could allow unauthorized database access and potential data exfiltration of network monitoring data.. A patch is available.

Is there a public PoC exploit available for CVE-2026-26990?

Yes, a public proof-of-concept exploit is available for CVE-2026-26990. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-26990?

Within 24 hours: Identify all LibreNMS deployments and document versions in use; assess internet exposure of affected instances. Within 7 days: Apply available vendor patch to all LibreNMS installations or implement WAF rules blocking malicious address parameter patterns; validate patches in test environment first. Within 30 days: Conduct database audit for unauthorized access logs during the vulnerability window; document patch deployment across all systems.

PHP CVE-2026-26990

HIGH

SQL Injection (CWE-89)

2026-02-20 security-advisories@github.com

GHSA-79q9-wc6p-cf92

PHP MySQL SNMP SQLi Librenms

8.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:04 vuln.today

PoC Detected

Feb 20, 2026 - 16:24 vuln.today

Public exploit code

Patch released

Feb 20, 2026 - 16:24 nvd

Patch available

CVE Published

Feb 20, 2026 - 02:16 nvd

HIGH 8.8

DescriptionGitHub Advisory

LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Versions 25.12.0 and below have a Time-Based Blind SQL Injection vulnerability in address-search.inc.php via the address parameter. When a crafted subnet prefix is supplied, the prefix value is concatenated directly into an SQL query without proper parameter binding, allowing an attacker to manipulate query logic and infer database information through time-based conditional responses. This vulnerability requires authentication and is exploitable by any authenticated user. This issue has been fixedd in version 26.2.0.

AnalysisAI

SQL injection in LibreNMS versions 25.12.0 and below allows authenticated users to extract sensitive database information through time-based blind SQL injection in the address-search function. An attacker with valid credentials can manipulate the subnet prefix parameter to bypass query logic and infer data through conditional timing responses. Public exploit code exists for this vulnerability; upgrade to version 26.2.0 or later to remediate.

Technical ContextAI

Classified as CWE-89 (SQL Injection). Affects the address component of Librenms. LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Versions 25.12.0 and below have a Time-Based Blind SQL Injection vulnerability in address-search.inc.php via the address parameter. When a crafted subnet prefix is supplied, the prefix value is concatenated directly into an SQL query without proper parameter binding, allowing an attacker to manipulate query logic and infer database information through time-based conditional responses. This vulnerability requires authen

RemediationAI

A vendor patch is available — apply it immediately. Use parameterized queries. Implement input validation. Restrict network access to the affected service where possible.