CVE-2026-26989

4.8 mediumEPSS 0.3%

Medium (4.8) in librenms librenms. EPSS 0.3% chance of exploitation in the next 30 days.

LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Versions 25.12.0 and below are affected by a Stored Cross-Site Scripting (XSS) vulnerability in the Alert Rules workflow. An attacker with administrative privileges can inject malicious scripts that execute in the browser context of any user who accesses the Alert Rules page. This issue has been fixed in version 26.2.0.

Severity

CVSS 3.1

4.8 medium

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 19% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2026-02-20
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

librenms:librenms

References

https://github.com/librenms/librenms/commit/087608cf9f851189847cb8e8e5ad002e59170c58
https://github.com/librenms/librenms/pull/19039
https://github.com/librenms/librenms/releases/tag/26.2.0
https://github.com/librenms/librenms/security/advisories/GHSA-6xmx-xr9p-58p7

Check your stack JSON