Hi,

Would it be possible to replace libcurl.dll in NetXMS agent with a version above 8.21.0 to address CVE-2026-8927 (https://nvd.nist.gov/vuln/detail/CVE-2026-8927)?

Thank you,
Leo

Hi Leo,

Yes — libcurl.dll will be updated to 8.21.0 or later in the next agent build. It's bundled with the Windows agent, server, client and web UI installers, so all of them get the new DLL.

That said, NetXMS itself is not exploitable through this bug, so there's no urgency here.

CVE-2026-8927 needs four things to line up at once:

1. the proxy is configured through environment variables rather than CURLOPT_PROXY,
2. a curl handle is reused across sequential transfers,
3. the proxy changes between those transfers, and
4. the first transfer authenticated to the proxy using Digest.

The fourth one never happens in NetXMS. libcurl only negotiates Digest against a proxy if the application sets CURLOPT_PROXYAUTH to include CURLAUTH_DIGEST or CURLAUTH_ANY — the default for that option is CURLAUTH_BASIC. We never set CURLOPT_PROXYAUTH anywhere in the codebase, in the agent or the server. So the stale Proxy-Authorization state that the CVE describes is never created in the first place.

Worth heading off one thing that looks related but isn't: the agent's web service support does offer Digest as an authentication option (WebServiceAuthType::DIGEST). That is passed to CURLOPT_HTTPAUTH, which authenticates to the web service itself via the Authorization header. Proxy authentication (Proxy-Authorization) is a separate state machine and is not affected.

If your scanner is flagging the DLL by version rather than by reachability, and you'd rather not wait for the next build, you can drop a newer libcurl.dll into the agent's bin directory yourself. curl keeps its ABI stable across the 8.x series, so a straight 8.21.0 replacement works. Two caveats: it will be overwritten on the next agent upgrade, and it won't carry our code signature.

Ticket: https://github.com/netxms/netxms/issues/3398