Vulnerability Description
LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Versions 25.12.0 and below are vulnerable to Reflected XSS attacks via email field. This issue has been fixed in version 26.2.0.
CVSS Score
6.1
MEDIUM
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Librenms | Librenms | < 26.2.0 |
Related Weaknesses (CWE)
References
- https://github.com/librenms/librenms/commit/8e626b38ef92e240532cdac2ac7e38706a71Patch
- https://github.com/librenms/librenms/pull/19038Issue Tracking
- https://github.com/librenms/librenms/releases/tag/26.2.0ProductRelease Notes
- https://github.com/librenms/librenms/security/advisories/GHSA-gqx7-99jw-6fprExploitThird Party Advisory
FAQ
What is CVE-2026-26987?
CVE-2026-26987 is a vulnerability with a CVSS score of 6.1 (MEDIUM). LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Versions 25.12.0 and below are vulnerable to Reflected XSS attacks via email field. This issue has been fixed in version ...
How severe is CVE-2026-26987?
CVE-2026-26987 has been rated MEDIUM with a CVSS base score of 6.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-26987?
Check the references section above for vendor advisories and patch information. Affected products include: Librenms Librenms.