CVE-2026-26988Disclosure(librenms / librenms)

LOWCVSS 9.1 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Versions 25.12.0 and below contain an SQL Injection vulnerability in the ajax_table.php endpoint. The application fails to properly sanitize or parameterize user input when processing IPv6 address searches. Specifically, the address parameter is split into an address and a prefix, and the prefix portion is directly concatenated into the SQL query string without validation. This allows an attacker to inject arbitrary SQL commands, potentially leading to unauthorized data access or database manipulation. This issue has been fixed in version 26.2.0.

librenms CVEs Back to dashboard

0.0/ 10 priority

Sources & remediation

Patch / fix

https://github.com/librenms/librenms/commit/15429580baba03ed1dd377bada1bde4b7a1175a1

Exploit / PoC references

https://github.com/librenms/librenms/security/advisories/GHSA-h3rv-q4rq-pqcv

Other references

https://github.com/librenms/librenms/pull/18777

Weakness type (CWE)

CWE-89

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

librenms

Threat summary

4 mentions across 2 observed days
Momentum state: stable

What's happening

Technical details provided in 4 signals
Disclosure: 4 classified signals
Peaked 1d ago at 3 mentions (2026-02-20); latest day: 1
4 total mentions across 2 days

Affected systems

Vendors

librenms

Products

librenms

Deep dive

Activity timeline4 mentions / 2d

Signal classification1 categories

Disclosure

4100.0%

Referenced assets4 URLs

By indicator

Classification over time

Date	Total	Labels

2026-02-20	3	Disclosure3
2026-02-25	1	Disclosure1

Full discourse4 posts

CRAC Learning - Tech@cracbot227d
Disclosure
CVE-2026-26988 (CVSS:9.3, CRITICAL) is Analyzed. LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Versions 25.12.0 and below contain an SQL ..https://nvd.nist.gov/vuln/detail/CVE-2026-26988 #cybersecurityawareness #cybersecurity #CVE #infosec #hacker #nvd #mitre
Post summary
The post references CVE-2026-26988, noting its critical severity and SQL-related flaw in LibreNMS versions 25.12.0 and earlier, but provides no evidence of exploitation or mitigation.
0001038
172 followersView on X
The Hacker Wire@TheHackerWire232d
Disclosure
🔴 CVE-2026-26988 - Critical LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Versions 25.12.0 and below contain an SQL Injection vulnerability in the ajax_table.php endpoint. The applica... https://www.thehackerwire.com/vulnerability/CVE-2026-26988/ https://t.co/WujG2eL8em
Post summary
The tweet announces a critical SQL injection vulnerability (CVE-2026-26988) in LibreNMS affecting versions 25.12.0 and below, without indicating any PoC, exploit, or patch.
0001035
112 followersView on X
Vulmon Vulnerability Feed@VulmonFeeds232d
Disclosure
CVE-2026-26988 SQL Injection Vulnerability in LibreNMS 25.12.0 via Unsanitized IPv6 Address Prefix https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-26988
Post summary
CVE-2026-26988 is a disclosed SQL injection vulnerability in LibreNMS 25.12.0 triggered by unsanitized IPv6 address prefixes.
0001051
4.0K followersView on X
CVE@CVEnew232d
Disclosure
CVE-2026-26988 LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Versions 25.12.0 and below contain an SQL Injection vulnerability in the ajax_table.php … https://www.cve.org/CVERecord?id=CVE-2026-26988
Post summary
CVE-2026-26988 is an SQL Injection vulnerability in the ajax_table.php of LibreNMS versions 25.12.0 and earlier; no PoC, exploit, or patch is referenced in the text.
0000083
56.4K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	librenms	librenms	-	-	-

Explore more

Back to dashboard librenms CVEs librenms vulnerabilities

What researchers are saying

CVE-2026-26988

CRAC Learning - Tech@cracbotDisclosure

The post references CVE-2026-26988, noting its critical severity and SQL-related flaw in LibreNMS versions 25.12.0 and earlier, but provides no evidence of exploitation or mitigation.

The Hacker Wire@TheHackerWireDisclosure

The tweet announces a critical SQL injection vulnerability (CVE-2026-26988) in LibreNMS affecting versions 25.12.0 and below, without indicating any PoC, exploit, or patch.

Vulmon Vulnerability Feed@VulmonFeedsDisclosure

CVE-2026-26988 is a disclosed SQL injection vulnerability in LibreNMS 25.12.0 triggered by unsanitized IPv6 address prefixes.

CVE@CVEnewDisclosure

CVE-2026-26988 is an SQL Injection vulnerability in the ajax_table.php of LibreNMS versions 25.12.0 and earlier; no PoC, exploit, or patch is referenced in the text.