All vulnerabilities
CVE-2026-39902GHSA-c4qp-j9r9-fq24

Cacti: Authenticated RCE on Data Input

Cacti cactiApplications & CMS
Open in ThreatlineRecord JSON
CVSS
7.2High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.57%Chance of exploitation activity in the next 30 days, higher than 46% of CVEs. Scored 24 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
Published23 Oct 2026Updated 23 Oct 2026CVE List

What fixes it

No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.

Description

Cacti is an open source performance and fault management framework. Prior to version 1.2.31, the prior blocklist ([;&| $\\n\r]) omitted single-quote, double-quote, redirect operators, subshell parens and braces. An authenticated admin could save an input_string containing single-quote, redirect operator, or subshell parens, and pass the check. This issue has been patched in version 1.2.31.

Text from CVE List

Affected versions 1

  • cactiaffected: < 1.2.31CVE List

References 2