CVE-2026-6204

LibreNMS versions prior to 26.3.0 contain an authenticated remote code execution vulnerability that can be exploited by abusing the Binary Locations configuration option and the Netcommand feature. Successful exploitation requires administrative privileges and could lead to complete compromise of the underlying web server, including confidentiality, integrity, and availability impacts. The vulnerability has a CVSS score of 7.2 (HIGH) with a network-based attack vector and low attack complexity. The network-accessible nature of LibreNMS and the absence of user interaction requirements mean that an authenticated administrator could execute arbitrary code with minimal friction once access is obtained. There is currently no evidence of active exploitation in the wild, as indicated by the lack of KEV (Known Exploited Vulnerability) designation and its inactive status on security hotlists. The EPSS score of 0.00005 suggests minimal real-world exploitation probability relative to other CVEs, though organizations running vulnerable versions should prioritize patching to version 26.3.0 or later given the severity of potential impacts.