CVE Intelligence
Analysis AI-assisted

CVE-2026-40079: Cacti: OS Command Injection via escape_command()

Cacti versions 1.2.30 and earlier are affected by an OS command injection flaw (CWE-78) caused by missing sanitization in escape_command(). The issue is fixed in version 1.2.31, and NVD rates it 9.8 under CVSS 3.1, while GitHub's CNA rates it 8.6 under CVSS 4.0. The CVE is not listed in CISA KEV, and no confirmed exploitation appears in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

Cacti is an open source performance and fault management framework. CVE-2026-40079 is an OS command injection weakness (CWE-78) affecting Cacti versions 1.2.30 and earlier. According to the record, the escape_command() function in lib/rrd.php does not sanitize its input, so values used to build a graph command line can reach the system shell without adequate escaping. The vendor has fixed the issue in version 1.2.31.

Impact

  • The NVD record gives a CVSS 3.1 base score of 9.8 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating network exploitation with high impact on confidentiality, integrity and availability.
  • GitHub's CNA lists a CVSS 4.0 score of 8.6.
  • Inference: a successful command injection could let an attacker run operating system commands with the privileges of the Cacti process, which may expose the host and connected data.

Affected products and versions

  • Product: Cacti Cacti
  • Affected range: < 1.2.31 (the description states versions 1.2.30 and prior are vulnerable)
  • Fixed in: 1.2.31

Exploitation status

  • The CVE is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog in the record.
  • No confirmed exploitation in the wild appears in the sources consulted for this analysis.
  • No EPSS data is available in the record.

Remediation and mitigation

  • Upgrade Cacti to version 1.2.31 or later, as indicated by the vendor advisory and the fixing commit.
  • Review the GitHub security advisory and the fixing commit to confirm the change set applied in your environment.
  • If an upgrade cannot be applied immediately, inference: limit network access to the Cacti web interface to trusted administrators and restrict who can create or edit graph templates and host variables.
  • Treat graph template text formats as untrusted input until the fix is deployed.

Detection guidance

  • Review web server and Cacti application logs for unusual requests to graph generation and template editing functions.
  • Monitor the Cacti host for unexpected child processes spawned by the PHP or web server process.
  • Audit existing graph templates and host variable configurations for unexpected or unusual text format content.

Limitations of the available information

  • The record does not describe the precise preconditions or required privileges beyond the CVSS vector and the description.
  • The record does not provide EPSS scores, SSVC data or KEV-specific guidance beyond the absence of a KEV listing.
  • Whether additional vendor-supplied backports exist for other branches is unknown from the record.
  • The record's title field is empty; the title in this analysis was written from the CWE and product data.

Frequently asked questions

Which Cacti versions are affected by CVE-2026-40079?

The record states that Cacti versions 1.2.30 and prior are vulnerable, and the affected range is listed as versions below 1.2.31.

Is CVE-2026-40079 known to be exploited?

The CVE is not listed in CISA KEV in the record, and no confirmed exploitation appears in the sources consulted for this analysis.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.