CVE-2026-39902: Cacti: Authenticated RCE on Data Input

Q: Which deployments are exposed?

Cacti versions prior to 1.2.31 are affected. Exploitation requires an authenticated administrator account, so instances where administrative access is tightly controlled have a narrower exposure than those with compromised or broadly delegated admin accounts.

Q: What must an attacker be able to do to exploit this issue?

The attacker needs authenticated administrative access and must be able to save a crafted input_string value. The vulnerable filtering omitted single and double quotes, redirect operators, subshell parentheses, and braces, allowing command-injection syntax to pass the prior blocklist.

Q: How can I determine whether my instance is remediated?

Verify that Cacti is running version 1.2.31 or later. The issue is patched in 1.2.31.

Published Oct 23, 2026

Updated

Cacti is an open source performance and fault management framework. Prior to version 1.2.31, the prior blocklist ([;&| $\\n\r]) omitted single-quote, double-quote, redirect operators, subshell parens and braces. An authenticated admin could save an inputstring containing single-quote, redirect operator, or subshell parens, and pass the check. This issue has been patched in version 1.2.31.

Affected Software

1 affected component

Cacti Cacti<1.2.31

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Cacti to a version that resolves this vulnerability.
Fixed in 1.2.31

Event History

Oct 23, 2026

CVE Published

via MITRE·02:42 PM

Data Sourced

via MITRE·02:42 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed?

Cacti versions prior to 1.2.31 are affected. Exploitation requires an authenticated administrator account, so instances where administrative access is tightly controlled have a narrower exposure than those with compromised or broadly delegated admin accounts.

What must an attacker be able to do to exploit this issue?