CVE-2026-2728

LibreNMS versions prior to 26.3.0 contain an authenticated cross-site scripting (XSS) vulnerability in the showconfig page that allows attackers with administrative privileges to inject malicious scripts affecting other users with page access. The vulnerability has a CVSS score of 4.8 (Medium severity) with a network-based attack vector and low complexity, requiring high-level privileges and user interaction but capable of compromising confidentiality and integrity across multiple security domains. The vulnerability has an extremely low exploitation probability (EPSS score of 0.000040000) and is not currently listed on the Known Exploited Vulnerabilities catalog, indicating no active exploitation in the wild or public exploit availability. Given the requirement for administrative privileges and relatively low severity rating, this poses a limited risk to most LibreNMS deployments, though administrators should apply the 26.3.0 patch or later as part of routine security maintenance.