LibreNMS versions older than 26.3.0 contain a flaw that lets an authenticated administrator alter the Binary Locations configuration and use the Netcommand feature to inject and execute arbitrary operating‑system commands. This command‑injection weakness (CWE‑78) gives the attacker full control of the web server’s environment and can lead to compromise of the host operating system. Because the flaw requires administrative privileges, the impact is limited to users who can log into the web interface with admin rights, but any such user can achieve remote code execution.

Affected deployments are those running LibreNMS releases earlier than 26.3.0. Only the librenms:librenms product is impacted; all other applications or services are unaffected unless they ship this code base internally.

The CVSS score of 8.5 signals a high severity vulnerability, and an EPSS score of 8% indicates a non‑negligible likelihood that attackers will target this weakness. The flaw is not currently tracked in the CISA KEV catalog. Exploitation requires an authenticated session with administrative rights; the attacker must log into the web console, modify the Binary Locations setting to reference a malicious executable, and then trigger Netcommand to cause the server to run that code. Once executed, the attacker can gain full control of the underlying operating system.