CVE-2026-39955

This vulnerability is like leaving a “no-password” door into the system’s database. If someone finds that door, they may be able to read, change, or delete data stored by Cacti, and possibly disrupt the service.

This matters if your small business runs the open-source monitoring tool Cacti, especially if the Cacti web pages are reachable from the network. The risk is highest when the server can receive web requests from an attacker (because the flaw can be exploited without authentication). If Cacti is not reachable from the public internet and is properly network-restricted, exposure is reduced.

Treat this as high priority: it’s a pre-authentication SQL injection, meaning an attacker does not need a login to try it. Even though there’s no confirmed public exploit code or KEV listing in the findings, the vulnerability directly enables database read/modify/delete over the network, so you should act promptly.

Verdict: AMBER—prioritize upgrading soon, with immediate restriction of access if you’re exposed.

1. Confirm exposure

   • Identify the Cacti version you run (target: 1.2.30 or earlier).
   • Confirm whether the Cacti web interface (graph_view.php) is reachable from untrusted networks (for example, the public internet).

2. Confirm likely exposure

   • If you have web server access logs, search for unusual requests to graph_view.php (especially requests that include abnormal parameters).
   • Compare timestamps to any authentication failures or other suspicious events.

3. Upgrade remediation (the fix)

   • Upgrade Cacti to 1.2.31 (fixed version) or later.
   • If you manage Cacti via an automated deployment process, roll out the upgrade through your normal pipeline and verify the site loads correctly after the update.

4. Workaround if patching is delayed

   • Restrict network access to the Cacti web UI so it is not reachable from the public internet (allow only specific IPs/VPN networks).
   • If you have a reverse proxy/WAF, ensure it only permits expected traffic patterns to the Cacti endpoints.

5. After the upgrade

   • Re-check that the instance is truly running 1.2.31+.
   • Continue monitoring logs for probing attempts.

CISA KEV: not listed in the findings, so there is no mandated “known exploited” deadline from KEV in this report.

Severity is extremely high due to pre-authentication SQL injection (CWE-89) in Cacti’s graph_view.php, where input validation uses unanchored FILTER_VALIDATE_REGEXP logic. Because it’s pre-authentication, an attacker can send crafted network requests to trigger unauthorized SQL execution without needing a valid session.

Exploitation status from the findings: no public exploit code on record and not listed in CISA KEV, so there is no finding-backed confirmation of widespread exploitation. The traffic-light verdict is therefore AMBER rather than a fully immediate “confirmed exploited” posture.

Patch status: fixed in Cacti 1.2.31. Vendor references include a commit and a GHSA advisory.