Is there a public PoC exploit available for CVE-2026-86176?

Yes, a public proof-of-concept exploit is available for CVE-2026-86176. Prioritise patching immediately. EPSS: 0.2%.

NetBox CVE-2026-86176

Q: What is the CVSS score of CVE-2026-86176?

CVE-2026-86176 has a CVSS 4.0 base score of 5.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-71975 MEDIUM

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-09-05 VulnCheck

GHSA-mx7r-5p73-mr7p

Netbox Netbox Community

5.3

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

5.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

4.3 MEDIUM

Network-accessible API requires only low-privilege authentication; impact is limited confidentiality of user-activity metadata with no integrity or availability effect.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Metadata Corrected

Sep 05, 2026 - 11:40 vuln.today

tag: Authentication Bypass removed

Analysis Generated

Sep 05, 2026 - 11:33 vuln.today

CVSS changed

Sep 05, 2026 - 11:22 NVD

4.3 (MEDIUM) 5.3 (MEDIUM)

CVE Published

Sep 05, 2026 - 11:01 cve.org

MEDIUM 5.3

DescriptionCVE.org

NetBox through 4.7.0 fails to properly scope user-private records in REST and GraphQL API endpoints for Notifications, Subscriptions, and Bookmarks. Authenticated users with view permissions can access all users' private records through unscoped querysets, disclosing which users watch or bookmark which objects.

AnalysisAI

Cross-user disclosure in NetBox through 4.7.0 exposes all users' private Notifications, Subscriptions, and Bookmark records to any authenticated user with standard view permissions, via unscoped querysets in both the REST API and GraphQL API. The root cause is CWE-639 (Authorization Bypass Through User-Controlled Key): affected endpoints return the full table rather than filtering records to the requesting user's identity. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires a valid NetBox account with at minimum view permissions on one of the affected object types: Notifications, Subscriptions, or Bookmarks. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N) and score of 5.3 are proportionate: the flaw is network-exploitable with low complexity but bounded to authenticated users and limited to confidentiality of user-activity metadata. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	No vendor-released patch version is confirmed in the available data; the references point to the v4.7.0 source but not to a fixed tagged release. … Detailed patch versions, workarounds, and compensating controls in full report.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Netbox

View all

CVE-2023-33796 CRITICAL Act Now POC

9.1 May 24

A vulnerability in Netbox v3.5.1 allows unauthenticated attackers to execute queries against the GraphQL database, grant

CVE-2026-29514 HIGH This Week POC

8.7 May 04

Remote code execution in NetBox 4.3.5-4.5.4 allows authenticated users with exporttemplate or configtemplate permissions

CVE-2026-86175 HIGH This Week POC

7.1 Sep 05

Credential exposure in NetBox through 4.7.0 allows any authenticated user with only view-level permissions to retrieve p

CVE-2024-56917 HIGH This Week POC

7.1 Jun 24

A cross-site scripting vulnerability in Netbox Community 4.1.7 (CVSS 7.1). Risk factors: public PoC available.

CVE-2024-56915 MEDIUM This Month POC

6.5 Jun 26

Netbox Community v4.1.7 and fixed in v.4.2.2 is vulnerable to Cross Site Scripting (XSS) via the RSS feed widget.

CVE-2024-56918 MEDIUM This Month POC

6.1 Jun 24

In Netbox Community 4.1.7, the login page is vulnerable to cross-site scripting (XSS), which allows a privileged, authen

CVE-2024-56916 MEDIUM This Month POC

6.1 Jun 24

In Netbox Community 4.1.7, once authenticated, Configuration History > Add`is vulnerable to cross-site scripting (XSS) d

CVE-2024-40742 MEDIUM This Month POC

6.1 Jul 09