LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool.

Code

The project this record applies to. Exploit listings stay in References.

• Repository · github.com

Timeline

Detection, updates, and resolution for this record.

1. Feb 20, 2026 · NIST NVD

   Detected

   LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Versions 24.10.0 through 26.1.1 are vulnerable to Stored XSS via the unit parameter in Custom OID. The Custom OID functionality lacks strip_tags() sanitization while other fields (name, oid, datatype) are sanitized. The unsanitized value is stored in the database and rendered without HTML escaping. This issue is fixed in

2. Jun 17, 2026 · NIST NVD

   Updated

   LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Versions 24.10.0 through 26.1.1 are vulnerable to Stored XSS via the unit parameter in Custom OID. The Custom OID functionality lacks strip_tags() sanitization while other fields (name, oid, datatype) are sanitized. The unsanitized value is stored in the database and rendered without HTML escaping. This issue is fixed in

Affected

• cpe librenms/librenmsversion unspecified

Sources

• CVE.orgVulnerability recordCVE-2026-27016

  Official CVE identifier

  cve.org
• NIST NVDVulnerability recordCVE-2026-27016

  LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Versions 24.10.0 through 26.1.1 are vulnerable to Stored XSS via the unit parameter in Custom OID. The Custom OID functionality lacks strip_tags() sanitization while other fields (name, oid, datatype) a

  nvd.nist.gov

References

• Patch · github.com
• Issue Tracking · github.com
• Product · github.com
• Third Party Advisory · github.com