Vulnerability intelligence

CVE-2026-39938

Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior have unauthenticated LFI through graph_theme and rrdtool IPC serialization hardening. This issue has been resolved in version 1.2.31.

CVSS Score

9.8

Critical

EPSS — Exploit Probability

0.4%

Riskier than 35% of all CVEs

Exploitation

Not in CISA KEV

No federal exploitation record

Remediation

Patch available

Vendor fix published

NVD entry Vendor patch PoC / advisory

1 article across 1 outlet · first covered Jun 30, 2026 · latest Jun 30, 2026

Coverage timeline

Cacti issues fix for critical preauth SQLi and file inclusion flaw
securityonline.info · Jun 30, 2026