CVE-2026-26992

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-26992", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-02-17T01:41:24.606Z", "datePublished": "2026-02-20T02:26:32.702Z", "dateUpdated": "2026-02-20T15:53:20.444Z"}, "containers": {"cna": {"title": "LibreNMS has Stored Cross-Site Scripting via unsanitized /port-groups name", "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "baseScore": 5.1, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/librenms/librenms/security/advisories/GHSA-93fx-g747-695x", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/librenms/librenms/security/advisories/GHSA-93fx-g747-695x"}, {"name": "https://github.com/librenms/librenms/pull/19042", "tags": ["x_refsource_MISC"], "url": "https://github.com/librenms/librenms/pull/19042"}, {"name": "https://github.com/librenms/librenms/commit/882fe6f90ea504a3732f83caf89bba7850a5699f", "tags": ["x_refsource_MISC"], "url": "https://github.com/librenms/librenms/commit/882fe6f90ea504a3732f83caf89bba7850a5699f"}, {"name": "https://github.com/librenms/librenms/releases/tag/26.2.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/librenms/librenms/releases/tag/26.2.0"}], "affected": [{"vendor": "librenms", "product": "librenms", "versions": [{"version": "< 26.2.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-20T02:26:32.702Z"}, "descriptions": [{"lang": "en", "value": "LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. In versions 26.1.1 and below, the port group name is not sanitized, allowing attackers with admin privileges to perform Stored Cross-Site Scripting (XSS) attacks. When a user adds a port group, an HTTP POST request is sent to the Request-URI \"/port-groups\". The name of the newly created port group is stored in the value of the name parameter. After the port group is created, the entry is displayed along with relevant buttons such as Edit and Delete. This issue has been fixed in version 26.2.0."}], "source": {"advisory": "GHSA-93fx-g747-695x", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-20T15:52:54.647707Z", "id": "CVE-2026-26992", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-20T15:53:20.444Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-26992", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-20T15:52:54.647707Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-20T15:53:14.607Z"}}], "cna": {"title": "LibreNMS has Stored Cross-Site Scripting via unsanitized /port-groups name", "source": {"advisory": "GHSA-93fx-g747-695x", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "LOW"}}], "affected": [{"vendor": "librenms", "product": "librenms", "versions": [{"status": "affected", "version": "< 26.2.0"}]}], "references": [{"url": "https://github.com/librenms/librenms/security/advisories/GHSA-93fx-g747-695x", "name": "https://github.com/librenms/librenms/security/advisories/GHSA-93fx-g747-695x", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/librenms/librenms/pull/19042", "name": "https://github.com/librenms/librenms/pull/19042", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/librenms/librenms/commit/882fe6f90ea504a3732f83caf89bba7850a5699f", "name": "https://github.com/librenms/librenms/commit/882fe6f90ea504a3732f83caf89bba7850a5699f", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/librenms/librenms/releases/tag/26.2.0", "name": "https://github.com/librenms/librenms/releases/tag/26.2.0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. In versions 26.1.1 and below, the port group name is not sanitized, allowing attackers with admin privileges to perform Stored Cross-Site Scripting (XSS) attacks. When a user adds a port group, an HTTP POST request is sent to the Request-URI \"/port-groups\". The name of the newly created port group is stored in the value of the name parameter. After the port group is created, the entry is displayed along with relevant buttons such as Edit and Delete. This issue has been fixed in version 26.2.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-20T02:26:32.702Z"}}}, "cveMetadata": {"cveId": "CVE-2026-26992", "state": "PUBLISHED", "dateUpdated": "2026-02-20T15:53:20.444Z", "dateReserved": "2026-02-17T01:41:24.606Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-02-20T02:26:32.702Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "librenms", "vendor": "librenms", "versions": [{"status": "affected", "version": "< 26.2.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:librenms:librenms:*:*:*:*:*:*:*:*", "matchCriteriaId": "C0838E1C-0369-4B31-9B51-83A5D2A7CAC9", "versionEndExcluding": "26.2.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. In versions 26.1.1 and below, the port group name is not sanitized, allowing attackers with admin privileges to perform Stored Cross-Site Scripting (XSS) attacks. When a user adds a port group, an HTTP POST request is sent to the Request-URI \"/port-groups\". The name of the newly created port group is stored in the value of the name parameter. After the port group is created, the entry is displayed along with relevant buttons such as Edit and Delete. This issue has been fixed in version 26.2.0."}, {"lang": "es", "value": "LibreNMS es una herramienta de monitorizaci\u00f3n de red basada en PHP/MySQL/SNMP con descubrimiento autom\u00e1tico. En las versiones 26.1.1 e inferiores, el nombre del grupo de puertos no se sanea, lo que permite a atacantes con privilegios de administrador realizar ataques de Stored Cross-Site Scripting (XSS). Cuando un usuario a\u00f1ade un grupo de puertos, se env\u00eda una solicitud HTTP POST a la Request-URI '/port-groups'. El nombre del grupo de puertos reci\u00e9n creado se almacena en el valor del par\u00e1metro name. Despu\u00e9s de que se cree el grupo de puertos, la entrada se muestra junto con botones relevantes como Editar y Eliminar. Este problema se ha solucionado en la versi\u00f3n 26.2.0."}], "id": "CVE-2026-26992", "lastModified": "2026-06-17T10:26:30.167", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.7, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.1, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-26992", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-20T15:52:54.647707Z", "version": "2.0.3"}}]}, "published": "2026-02-20T03:16:00.990", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/librenms/librenms/commit/882fe6f90ea504a3732f83caf89bba7850a5699f"}, {"source": "security-advisories@github.com", "tags": ["Issue Tracking"], "url": "https://github.com/librenms/librenms/pull/19042"}, {"source": "security-advisories@github.com", "tags": ["Product", "Release Notes"], "url": "https://github.com/librenms/librenms/releases/tag/26.2.0"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Third Party Advisory"], "url": "https://github.com/librenms/librenms/security/advisories/GHSA-93fx-g747-695x"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,26.2.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "librenms", "source": "cna", "vendor": "librenms"}, "product": "librenms", "vendor": "librenms"}], "analysis": {"en": {"generated_at": "2026-04-17T17:32:51.811162+00:00", "value": {"mitigation_remediation": ["Upgrade LibreNMS to version 26.2.0 or later to apply the fix that sanitizes port\u2011group names.", "Review existing port groups created before the patch; delete any with suspicious or non\u2011ASCII characters and recreate them with safe names.", "Limit the creation or modification of port groups to a narrow set of trusted administrators and enforce least\u2011privilege access controls."], "summary": {"action": "Apply Patch", "impact": "Stored Cross\u2011Site Scripting"}, "threat_synthesis": {"affected_systems": "The vulnerability impacts LibreNMS deployments running version 26.1.1 or earlier. The vendor product is LibreNMS, an open\u2011source network monitoring system. The affected components are the web interface handling POST requests to /port\u2011groups. The fix is available in release 26.2.0.", "description_and_impact": "LibreNMS, a PHP/MySQL/SNMP network monitoring platform, has a stored cross\u2011site scripting flaw in versions 26.1.1 and earlier. The vulnerability arises when the name of a port group is accepted without sanitization during creation. An attacker with administrative access can inject crafted JavaScript into the name field. Once the port group is stored, any subsequent viewing of the group\u2014such as on the listing page with Edit and Delete buttons\u2014will execute the embedded script in the context of other users\u2019 browsers, potentially enabling session hijacking, credential theft, or defacement of the application for users who view the page.", "risk_and_exploitability": "The CVSS base score is 5.1, indicating moderate severity. EPSS shows an exploitation probability of less than 1%, suggesting the likelihood of exploitation is low. The vulnerability is not listed in CISA's KEV catalog. The attack vector requires the attacker to have administrative privileges to create a malicious port group, so compromised or mis\u2011privileged accounts pose the primary risk. A successful exploit would allow an attacker to compromise the sessions of other users who examine the port\u2011group list."}}}}, "created": "2026-02-20T09:52:49.386232+00:00", "updated": "2026-04-17T17:45:24.337630+00:00", "vendors": ["librenms", "librenms$PRODUCT$librenms"]}