Description
An issue was discovered in LibreNMS 1.65. A remote authenticated attacker with normal privileges can execute arbitrary shell commands through a command injection in the /graph.php API endpoint.
Published: 2026-08-26
Score: 8.8 High
EPSS: 2.3% Low
KEV: No
Impact: Remote Command Execution
Action: Immediate Patch
AI Analysis

Impact

The vulnerability is a remote authenticated command injection flaw in LibreNMS 1.65’s /graph.php API endpoint. An attacker who can log in with normal user privileges can construct input that causes the server to execute arbitrary shell commands. This allows the attacker to run any command with the privileges of the web server process on the host where LibreNMS is installed.

Affected Systems

The issue impacts LibreNMS version 1.65. No other affected versions or vendors are identified in the CVE report.

Risk and Exploitability

The CVSS score of 8.8 reflects a high severity due to the potential for remote command execution. The EPSS score of 2% suggests a low but nonzero probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires only normal authenticated access over the network, meaning anyone with a valid LibreNMS login can attempt the attack.

Generated by OpenCVE AI on October 25, 2026 at 22:09 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the LibreNMS patch to upgrade to version 1.65.1 or later, which addresses the command injection issue.
  • If an upgrade is not immediately feasible, restrict access to the /graph.php endpoint by firewall or web server configuration, limiting it to trusted IP addresses.
  • Employ least privilege for the web server user, reducing the impact of any potential command execution.

Generated by OpenCVE AI on October 25, 2026 at 22:09 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 25 Oct 2026 22:30:00 +0000

Type Values Removed Values Added
Title Remote Authenticated Command Injection in LibreNMS 1.65 /graph.php

Sun, 25 Oct 2026 20:30:00 +0000

Type Values Removed Values Added
Title Remote Authenticated Command Injection in LibreNMS 1.65 /graph.php
Weaknesses CWE-78

Wed, 02 Sep 2026 08:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 02 Sep 2026 00:15:00 +0000

Type Values Removed Values Added
Title Remote Authenticated Command Injection via /graph.php in LibreNMS 1.65

Tue, 01 Sep 2026 22:00:00 +0000

Type Values Removed Values Added
Weaknesses CWE-77
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Wed, 26 Aug 2026 21:00:00 +0000

Type Values Removed Values Added
First Time appeared Librenms
Librenms librenms
Vendors & Products Librenms
Librenms librenms

Wed, 26 Aug 2026 19:30:00 +0000

Type Values Removed Values Added
Title Remote Authenticated Command Injection via /graph.php in LibreNMS 1.65
Weaknesses CWE-78

Wed, 26 Aug 2026 17:00:00 +0000

Type Values Removed Values Added
Description An issue was discovered in LibreNMS 1.65. A remote authenticated attacker with normal privileges can execute arbitrary shell commands through a command injection in the /graph.php API endpoint.
References

Subscriptions

Librenms Librenms
cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published:

Updated: 2026-09-01T18:37:18.998Z

Reserved: 2020-07-21T00:00:00.000Z

Link: CVE-2020-15874

cve-icon Vulnrichment

Updated: 2026-09-01T18:37:11.484Z

cve-icon NVD

Status : Deferred

Published: 2026-08-26T17:16:44.097

Modified: 2026-09-03T17:52:51.960

Link: CVE-2020-15874

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-25T22:15:14Z

Weaknesses
  • CWE-77

    Improper Neutralization of Special Elements used in a Command ('Command Injection')