CVE-2026-80214 LibreNMS Virtualisation Discovery Module RCE
An authenticated admin can execute arbitrary code on the host server via command injection in the Virtualization Discovery module.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-80214?
CVE-2026-80214 is a high-severity command injection vulnerability in librenms, published on 26 Aug 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
LibreNMS’s Virtualization Discovery module is vulnerable to command line injection. An authenticated admin user can execute arbitrary code on the host server.
Weakness: CWE-78
Which versions are affected by CVE-2026-80214?
How do I fix CVE-2026-80214?
No fix has been published for CVE-2026-80214 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-80214 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-80214 exists.
Sources
Also known as GHSA-7hmq-j399-mqwf, GHSA-gq95-24rp-w6h2.