Vulnerability intelligence

CVE-2026-39955

Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior have pre-authentication SQL Injection via unanchored FILTER_VALIDATE_REGEXP in graph_view.php. This issue has been fixed in version 1.2.31.

CVSS Score

9.8

Critical

EPSS — Exploit Probability

0.3%

Riskier than 23% of all CVEs

Exploitation

Not in CISA KEV

No federal exploitation record

Remediation

Patch available

Vendor fix published

NVD entry Vendor patch PoC / advisory

1 article across 1 outlet · first covered Jun 30, 2026 · latest Jun 30, 2026

Coverage timeline

Cacti issues fix for critical preauth SQLi and file inclusion flaw
securityonline.info · Jun 30, 2026