LibreNMS CVE-2026-80214

Exploitation requires a valid LibreNMS administrator session - the CVSS 4.0 PR:H metric explicitly confirms this is a high-privilege-required vulnerability, not exploitable by standard or read-only users. The injection point is specifically within the Virtualization Discovery module, which must be accessible in the LibreNMS interface (present in default deployments where virtualization monitoring is configured or enabled). Network-level access to the LibreNMS web interface is required (AV:N). No additional user interaction beyond the admin's own actions is needed (UI:N), and no special attack complexity or target-side preconditions are required (AC:L, AT:N) once admin credentials are held. Limiting factors: the requirement for valid admin credentials is the primary barrier; organizations that strongly segment LibreNMS admin access, enforce MFA, and restrict web interface exposure reduce exploitability substantially despite the vulnerability remaining present.

The CVSS 4.0 score of 8.6 reflects the severity of full host-level code execution, but the PR:H metric is the key moderating factor: an attacker must already hold valid LibreNMS administrator credentials before the injection can be triggered, ruling out direct unauthenticated exploitation. The VC:H and VI:H impact ratings are well-founded given that arbitrary OS command execution on the host grants access to network device credentials, SNMP community strings, and potentially lateral reach into monitored infrastructure. The availability of a public proof-of-concept from Project Black lowers the skill threshold significantly - even a mid-sized municipal IT team in walbrzych managing LibreNMS for their network estate should treat this as urgent patching rather than a deferred item. No EPSS data was supplied and CISA KEV listing is absent, so confirmed active exploitation at scale is unknown; the practical risk is highest in organisations where admin accounts are shared, weakly secured, or reachable from corporate LANs without additional segmentation.

An attacker who has compromised LibreNMS administrator credentials - via phishing, password reuse against a shared account, or insider access - authenticates to the LibreNMS web interface, navigates to the Virtualization Discovery module, and injects shell metacharacters into a relevant input parameter. The injected payload executes on the host server under the LibreNMS process account, potentially yielding a reverse shell or enabling exfiltration of SNMP credentials and device configurations. A ready-made proof-of-concept targeting version 26.5.0 is publicly available from Project Black, providing a concrete exploitation template.