CVE-2026-26987

MEDIUM EPSS 20.8%
Published Feb 20, 20264mo ago · Modified Jun 17, 20262w ago
5.3 CVSS 4.0
Medium
Find Similar
Published Feb 20, 2026 4mo ago
Last Modified Jun 17, 2026 2w ago

Description

LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Versions 25.12.0 and below are vulnerable to Reflected XSS attacks via email field. This issue has been fixed in version 26.2.0.

CVSS Details

Base Score
5.3
Exploitability
—
Impact
—
Vector string
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction P
Scope X

Threat Intelligence

EPSS Exploit Probability
20.8% percentile
Exploit & Patch Status
Public Exploit Known
Patch Available

Weaknesses 1

CWE-79 Cross-site Scripting Injection

Affected Products 1

VendorProductVersionRange
librenmslibrenms* <26.2.0

References 4

  • github.com https://github.com/librenms/librenms/commit/8e626b38ef92e240532cdac2ac7e38706a71208b
    Patch
  • github.com https://github.com/librenms/librenms/pull/19038
    Issue Tracking
  • github.com https://github.com/librenms/librenms/releases/tag/26.2.0
    ProductRelease Notes
  • github.com https://github.com/librenms/librenms/security/advisories/GHSA-gqx7-99jw-6fpr
    ExploitThird Party Advisory

Remediation

  • github.com https://github.com/librenms/librenms/commit/8e626b38ef92e240532cdac2ac7e38706a71208b
    Patch