PatchTheCVEnetbox vulnerabilities
Recent CVEs affecting netbox products. 7 tracked.
netbox has 7 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 5. Most recent: 2026-03-16. Highest priority: CVE-2024-56917 (score 38/100).
- CVE-2025-69848 MEDIUM 5.4 UPGRADE NetBox is an open-source infrastructure resource modeling and IP address management platform
- CVE-2025-57543 MEDIUM 6.1 DOWNGRADE Cross Site scripting vulnerability (XSS) in NetBox 4.3.5 "comment" field on object forms
- CVE-2024-56918 MEDIUM 6.1 UPGRADE In Netbox Community 4.1.7, the login page is vulnerable to cross-site scripting (XSS), which allows a privileg
- CVE-2024-56917 HIGH 7.1 UPGRADE Netbox Community 4.1.7 is vulnerable to Cross Site Scripting (XSS) via the maintenance banner` in maintenance
- CVE-2024-56916 MEDIUM 6.1 UPGRADE In Netbox Community 4.1.7, once authenticated, Configuration History > Add`is vulnerable to cross-site scripti
- CVE-2024-56915 MEDIUM 6.5 UPGRADE Netbox Community v4.1.7 and fixed in v.4.2.2 is vulnerable to Cross Site Scripting (XSS) via the RSS feed widg
- CVE-2024-47226 MEDIUM 5.4 DOWNGRADE A stored cross-site scripting (XSS) vulnerability exists in NetBox 4.1.0 within the "Configuration History" fe
FAQ
How do I fix netbox vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is netbox being exploited right now?
None of the tracked netbox CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which netbox CVE should I patch first?
CVE-2024-56917 currently ranks highest (38/100): Netbox Community 4.1.7 is vulnerable to Cross Site Scripting (XSS) via the maintenance banner` in maintenance .