Every CVE Search/ Get API key

CVE-2026-39902

Cacti: Authenticated RCE on Data Input

7.2 HighPublic exploitFix available

Cacti is an open source performance and fault management framework. Prior to version 1.2.31, the prior blocklist ([;&| $\\n\r]) omitted single-quote, double-quote, redirect operators, subshell parens and braces. An authenticated admin could save an input_string containing single-quote, redirect operator, or subshell parens, and pass the check. This issue has been patched in version 1.2.31.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
High
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

0.40%Down 0.2 points since Oct 24, 2026
90%50%10%1%

What each source reports

CVE List Score used 7.2

Cacti: Authenticated RCE on Data Input

Cacti is an open source performance and fault management framework. Prior to version 1.2.31, the prior blocklist ([;&| $\\n\r]) omitted single-quote, double-quote, redirect operators, subshell parens and braces. An authenticated admin could save an input_string containing single-quote, redirect operator, or subshell parens, and pass the check. This issue has been patched in version 1.2.31.

Record
CVE-2026-39902
CVSS 3.1
7.2 HighCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-78
Updated
2026-11-02
EUVDEUVD-2026-109088 7.2

Cacti is an open source performance and fault management framework. Prior to version 1.2.31, the prior blocklist ([;&| $\\n\r]) omitted single-quote, double-quote, redirect operators, subshell parens and braces. An authenticated admin could save an input_string containing single-quote, redirect operator, or subshell parens, and pass the check. This issue has been patched in version 1.2.31.

Record
EUVD-2026-109088
CVSS 3.1
7.2 HighCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
NVD 7.2

Cacti is an open source performance and fault management framework. Prior to version 1.2.31, the prior blocklist ([;&| $\\n\r]) omitted single-quote, double-quote, redirect operators, subshell parens and braces. An authenticated admin could save an input_string containing single-quote, redirect operator, or subshell parens, and pass the check. This issue has been patched in version 1.2.31.

Record
CVE-2026-39902
CVSS 3.1
7.2 HighCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-78
Updated
2026-11-02
OSV 7.2

Cacti: Authenticated RCE on Data Input

Cacti is an open source performance and fault management framework. Prior to version 1.2.31, the prior blocklist ([;&| $\\n\r]) omitted single-quote, double-quote, redirect operators, subshell parens and braces. An authenticated admin could save an input_string containing single-quote, redirect operator, or subshell parens, and pass the check. This issue has been patched in version 1.2.31.

Record
CVE-2026-39902
CVSS 3.1
7.2 HighCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-78
Updated
2026-11-02
OSVDEBIAN-CVE-2026-39902 7.2

Cacti is an open source performance and fault management framework. Prior to version 1.2.31, the prior blocklist ([;&| $\\n\r]) omitted single-quote, double-quote, redirect operators, subshell parens and braces. An authenticated admin could save an input_string containing single-quote, redirect operator, or subshell parens, and pass the check. This issue has been patched in version 1.2.31.

Record
DEBIAN-CVE-2026-39902
CVSS 3.1
7.2 HighCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-39902 7.2

Cacti is an open source performance and fault management framework. Prior to version 1.2.31, the prior blocklist ([;&| $\\n\r]) omitted single-quote, double-quote, redirect operators, subshell parens and braces. An authenticated admin could save an input_string containing single-quote, redirect operator, or subshell parens, and pass the check. This issue has been patched in version 1.2.31.

Record
UBUNTU-CVE-2026-39902
CVSS 3.1
7.2 HighCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
cacti
Debian:12
 All versions, plus listed versions
1.2.24+ds1-11.2.24+ds1-1+deb12u11.2.24+ds1-1+deb12u21.2.24+ds1-1+deb12u31.2.24+ds1-1+deb12u4
Show 17 moreShow less
1.2.24+ds1-1+deb12u51.2.25+ds1-11.2.25+ds1-21.2.26+ds1-11.2.27+ds1-11.2.27+ds1-21.2.28+ds1-11.2.28+ds1-21.2.28+ds1-31.2.28+ds1-41.2.30+ds1-11.2.30+ds1-21.2.30+ds1-31.2.31+ds1-11.2.31+ds1-21.2.31+ds1-31.2.31+ds1-4
 None known
cacti
Debian:13
 All versions, plus listed versions
1.2.30+ds1-11.2.30+ds1-21.2.30+ds1-31.2.31+ds1-11.2.31+ds1-21.2.31+ds1-31.2.31+ds1-4
 None known
cacti
Debian:14
 before 1.2.31+ds1-1, plus listed versions
1.2.30+ds1-11.2.30+ds1-21.2.30+ds1-3
1.2.31+ds1-1
cacti
Ubuntu:Pro:14.04:LTS
 All versions, plus listed versions
0.8.8b+dfsg-30.8.8b+dfsg-50.8.8b+dfsg-5ubuntu0.10.8.8b+dfsg-5ubuntu0.20.8.8b+dfsg-5ubuntu0.2+esm10.8.8b+dfsg-5ubuntu0.2+esm2
 None known
cacti
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
0.8.8f+ds1-20.8.8f+ds1-30.8.8f+ds1-40.8.8f+ds1-4ubuntu10.8.8f+ds1-4ubuntu2
Show 7 moreShow less
0.8.8f+ds1-4ubuntu30.8.8f+ds1-4ubuntu40.8.8f+ds1-4ubuntu4.16.040.8.8f+ds1-4ubuntu4.16.04.10.8.8f+ds1-4ubuntu4.16.04.20.8.8f+ds1-4ubuntu4.16.04.2+esm10.8.8f+ds1-4ubuntu4.16.04.2+esm2
 None known
cacti
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
1.1.18+ds1-11.1.27+ds1-21.1.27+ds1-31.1.28+ds1-21.1.35+ds1-1
Show 5 moreShow less
1.1.36+ds1-11.1.38+ds1-11.1.38+ds1-1ubuntu0.1~esm11.1.38+ds1-1ubuntu0.1~esm31.1.38+ds1-1ubuntu0.1~esm4
 None known
cacti
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
1.2.4+ds1-2ubuntu31.2.9+ds1-1ubuntu11.2.9+ds1-1ubuntu21.2.10+ds1-1ubuntu11.2.10+ds1-1ubuntu1+esm11.2.10+ds1-1ubuntu1.11.2.10+ds1-1ubuntu1.1+esm11.2.10+ds1-1ubuntu1.1+esm2
 None known
cacti
Ubuntu:Pro:22.04:LTS
 All versions, plus listed versions
1.2.16+ds1-2ubuntu11.2.19+ds1-2ubuntu11.2.19+ds1-2ubuntu1+esm11.2.19+ds1-2ubuntu1.11.2.19+ds1-2ubuntu1.1+esm11.2.19+ds1-2ubuntu1.1+esm2
 None known
cacti
Ubuntu:24.04:LTS
 All versions, plus listed versions
1.2.25+ds1-21.2.26+ds1-11.2.26+ds1-1ubuntu0.1
 None known
cacti
Ubuntu:26.10
 All versions, plus listed versions
1.2.30+ds1-1ubuntu21.2.30+ds1-1ubuntu31.2.31+ds1-3ubuntu2
 None known
cacti
Ubuntu:26.04:LTS
 All versions, plus listed versions
1.2.30+ds1-1ubuntu11.2.30+ds1-1ubuntu2
 None known

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubkx00007/CVE-2026-399022026-04-04

History

History
RecordedChangedSources
first indexedCVE List, EUVD, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-39902 is a high vulnerability (CVSS 7.2) in Cacti, published October 23, 2026. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 0.40%, the 34th percentile. Fixed in cacti 1.2.31+ds1-1.

References

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open