Medium severity · published Feb 20, 2026
CVE-2026-27016
LibreNMS has Stored XSS in Custom OID - unit parameter missing strip_tags()
5.4
CVSS
0.3%
EPSS
No
On KEV
Description
LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Versions 24.10.0 through 26.1.1 are vulnerable to Stored XSS via the unit parameter in Custom OID. The Custom OID functionality lacks strip_tags() sanitization while other fields (name, oid, datatype) are sanitized. The unsanitized value is stored in the database and rendered without HTML escaping. This issue is fixed in version 26.2.0.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 18% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LI
librenms · librenms
>= 24.10.0, < 26.2.0 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-27016
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-27016
Patch
https://github.com/librenms/librenms/commit/3bea263e02441690c01dea7fa3fe6ffec94af335
Issue Tracking
https://github.com/librenms/librenms/pull/19040
Product
https://github.com/librenms/librenms/releases/tag/26.2.0
Third Party Advisory
https://github.com/librenms/librenms/security/advisories/GHSA-fqx6-693c-f55g
More from librenms
9.8
CVE-2026-86426
LibreNMS before 26.8.0 Authentication Bypass via API Token Type Confusion
9.8
CVE-2022-4070
Insufficient Session Expiration in GitHub repository librenms/librenms prior to 22.10.0
9.8
CVE-2022-29712
LibreNMS v22.3.0 was discovered to contain multiple command injection vulnerabilities via the service_ip, hostname, and service_param parameters
9.8
CVE-2021-44278
Librenms 21.11.0 is affected by a path manipulation vulnerability in includes/html/pages/device/showconfig.inc.php
9.8
CVE-2019-10665
An issue was discovered in LibreNMS through 1.47