CVE-2026-399389.8CriticalCWE-22

CVE-2026-39938: cacti vulnerability

Cacti · cacti

Vendor fix available · Affected: cacti · Exploitation: public proof of concept (unverified)

ExploitationProof of concept public

Not in CISA KEV as of catalogue 2026.11.13 (13 Nov)

In CISA KEV: not seen
Exploited (reported): not seen
Scanning observed: not seen
Proof of concept public2 public GitHub repositories (unverified), listed by PoC-in-GitHub4 Apr
Not established: not seen

0.7%probability of exploitation in the next 30 days

53rd percentile

050100

Higher than 53% of scored CVEs

9.8CriticalCVSS 3.1

LowMediumHighCrit.

DescriptionNVD

Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior have unauthenticated LFI through graph_theme and rrdtool IPC serialization hardening. This issue has been resolved in version 1.2.31.

On the Atlas

Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.

Open the Atlas

Exploitation: Unlikely (under 1%). EPSS under 1%, or no score yet.
CISA KEV: Not listed
Public check: No public nuclei template
Weakness: Path Traversal · File and Path Handling
Vendor: Cacti
Published: June 2026
Band: Unlikely (under 1%), June 2026

What changed

4 Apr
PoC-in-GitHub lists 2 public GitHub repositories (unverified) PoC-in-GitHub

Coverage1 article · 1 outlet

First in our coverage: SecurityOnline, 30 Jun.

30 Jun 01:20
Cacti issues fix for critical preauth SQLi and file inclusion flaw
SecurityOnline · first in our coverage · mentions it in passing

New articles also arrive in the RSS feed.