LibreNMS through 26.2.0 contains a stored cross-site scripting vulnerability in legacy PHP template pages that render unescaped SNMP-sourced data… (CVE-2026-84193)

CVE-2026-84193 is a stored cross-site scripting vulnerability affecting LibreNMS through version 26.2.0. The flaw exists in legacy PHP template pages that render SNMP-sourced data fields without proper escaping, including BGP peer descriptions, VRF names, process information, and SLA tags. An attacker with device management privileges or network access to enroll a rogue SNMP device can inject malicious JavaScript payloads. These payloads execute in the context of an administrator's browser when viewing affected pages, allowing theft of credentials and exfiltration of CSRF tokens. This vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation). No known exploits in the wild have been reported, and no patch information is provided in the source data.

Successful exploitation allows attackers to execute arbitrary JavaScript in the context of an administrator's browser session. This can lead to credential theft and exfiltration of CSRF tokens, potentially compromising administrative access and enabling further attacks. The vulnerability requires either device management access or network access to enroll a rogue SNMP device, limiting the attack surface to trusted or internal network environments.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict device management access and control network enrollment of SNMP devices to trusted entities only. Administrators should be cautious when viewing routing and device pages that may render SNMP-sourced data. Monitor vendor channels for updates and apply patches promptly once released.