Live › vulnerability › CVE-2026-39902
Go to dashboardCacti, an open source network monitoring framework, filters input with a blocklist that misses quotes, redirects and subshell characters. An authenticated admin can save a crafted input string that gets past the filter and runs shell commands on the server.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Any Cacti install running a version before 1.2.31 is exposed, since the flaw is in the core input validation. Exposure requires an account with administrator rights, so teams that already restrict admin access have less risk. Installs already on or later are not affected.
1.2.31No product ranges from the sources yet.
php -r 'echo CACTI_VERSION;' or check the version shown in the Cacti web footer and confirm it is below 1.2.311.2.31 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Cacti is an open source performance and fault management framework. Prior to version 1.2.31, the prior blocklist ([;&| $\\n\r]) omitted single-quote, double-quote, redirect operators, subshell parens and braces. An authenticated admin could save an input_string containing single-quote, redirect operator, or subshell parens, and pass the check. This issue has been patched in version 1.2.31.
This page as .md · .json · in your agent: get_signal("CVE-2026-39902")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.