CVE Intelligence
Analysis AI-assisted

CVE-2026-39955: Cacti graph_view.php Pre-Authentication SQL Injection

CVE-2026-39955 is a critical SQL injection flaw in Cacti versions 1.2.30 and prior, reachable before authentication through an unanchored FILTER_VALIDATE_REGEXP check in graph_view.php. The vendor fixed it in version 1.2.31, and the record reports a CVSS 3.1 base score of 9.8. No confirmed exploitation appears in the sources consulted, and the CVE is not listed in CISA KEV.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-39955 affects Cacti, an open source performance and fault management framework. The flaw is an SQL injection that can be reached before authentication, caused by an unanchored FILTER_VALIDATE_REGEXP check in graph_view.php. The vendor states that it is fixed in version 1.2.31.

Impact

  • The record classifies the weakness as CWE-89 (SQL Injection), which can allow an attacker to influence database queries.
  • The CVSS 3.1 base score of 9.8 (critical) reflects network reachability, low complexity, no privileges required and no user interaction, with high impact on confidentiality, integrity and availability.
  • Because the issue is pre-authentication, exposure of the Cacti web interface is a key factor in risk.

Affected products and versions

  • Product: Cacti (vendor and product recorded as Cacti Cacti).
  • Affected: versions 1.2.30 and prior.
  • Fixed: version 1.2.31.

Exploitation status

The record shows that Cacti is not listed in CISA KEV for this CVE. No confirmed exploitation appears in the sources consulted. No EPSS value is available in the record.

Remediation and mitigation

  • Upgrade Cacti to version 1.2.31 or later, as indicated by the vendor advisory.
  • A patch commit is referenced in the record: Cacti patch commit.
  • Until the upgrade is applied, restrict access to the Cacti web interface to trusted networks and administrators, since the flaw is reachable without logging in.
  • Consult the vendor advisory for full details: GitHub Security Advisory GHSA-gp82-qhrg-crv7.

Detection guidance

  • Review web server and application logs for unusual or malformed input directed at graph_view.php.
  • Look for database error messages appearing in web responses or logs related to this page.
  • Confirm the installed Cacti version in the administration interface or in package metadata to identify instances still at 1.2.30 or earlier.

Limitations of the available information

  • The record does not provide an EPSS score, an SSVC result or a KEV entry.
  • The record does not describe the exact conditions needed to reach the flaw, nor any vendor-provided workaround.
  • Whether a given deployment is exposed depends on its configuration and network placement, which this analysis cannot verify.

Frequently asked questions

What is CVE-2026-39955?

It is a critical SQL injection vulnerability in Cacti versions 1.2.30 and prior. It is reachable through an unanchored FILTER_VALIDATE_REGEXP check in graph_view.php, before authentication.

Which version fixes the issue?

The record states that the issue is fixed in Cacti version 1.2.31. Upgrading to that version or later is the recommended remediation.

Is this vulnerability being actively exploited?

The record shows no KEV listing for this CVE, and no confirmed exploitation appears in the sources consulted.

What is the severity score?

The record reports a CVSS 3.1 base score of 9.8, rated critical, from the GitHub Security Advisories provider.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.