VulnerabilityPublished 16 Jun 2026

CVE-2026-39949: Authenticated Remote Code Execution in Cacti ≤ 1.2.30

Affects cactiSource Reddit Cybersecurity

Compare

Not known to be exploited.

Data as of 16 Jun 2026, 21:15 UTC

Severity

Medium

Rated by Threat Radar · No CVSS score from NVD or the CNA

Affects: Cacti up to 1.2.30

Exploitation evidence

Disclosed: evidence found.
Public on cve.org; its publication date is not in this record
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: evidence found.
Public exploit code: GitHub proofs of concept
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), GitHub proofs of concept, the Metasploit, Exploit-DB and nuclei-templates index as of 29 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponized: A Metasploit exploit module or Exploit-DB entry exists (Metasploit scanner modules do not count), or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Affected software

Product	Affected	Fixed in
GitHubcacti/cacti`pkg:github/cacti/cacti`Other threats	Affected <=1.2.30	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

AI-suggested

Until an official fix is available, restrict graph management privileges to trusted users only and monitor for updates from the Cacti project. Avoid using untrusted input in host metadata fields that are referenced in graph templates.

Discussion

CVE-2026-39949 is an authenticated remote code execution vulnerability in Cacti versions up to and including 1.2.30. The flaw arises from unsanitized variable substitution in RRDtool command-line arguments, allowing users with graph management privileges to inject arbitrary OS commands via host metadata fields such as the device notes. Exploitation requires authenticated access with permissions to create devices and graph templates. An attacker can craft malicious input in the notes field and trigger code execution during graph rendering.

r/cybersecurity (opens in a new tab)u/sysinternalssuite0 points0 comments

During recent testing on Cacti, an authenticated remote code execution vulnerability was discovered that allows users with graph management privileges to execute arbitrary commands on the underlying OS.

The vulnerability originates from Cacti's variable substitution engine, which allows graph templates to reference host metadata through variables such as |host_description|, |host_hostname|, and |host_notes|. During graph generation, these variables are expanded and incorporated into arguments passed to RRDtool.

Because user-controlled host metadata is substituted without sufficient validation or sanitization, an attacker can inject malicious input into a host field and trigger code execution when a graph is rendered.

This issue affects Cacti versions ≤ 1.2.30 and has been assigned CVE-2026-39949.

Link to the writeup: https://github.com/lukehebe/Vulnerability-Disclosures/blob/main/CVE-2026-39949.md
Link to the POC: https://github.com/lukehebe/CVE-2026-39949/tree/main
Link to Cacti changelog: https://github.com/Cacti/cacti/blob/develop/CHANGELOG#L231

Links cited in the discussion

Impact

Successful exploitation allows an authenticated user with device and graph template creation privileges to execute arbitrary commands on the underlying server with the web server user's privileges. This can lead to full remote code execution, potentially compromising the server hosting Cacti. The vulnerability requires authenticated access and specific permissions, limiting exposure to authorized users.

Summary

This vulnerability in Cacti (≤ 1.2.30) involves improper sanitization of user-controlled host metadata fields (notably the device notes) that are substituted into RRDtool command-line arguments without escaping. The variable substitution engine replaces tokens like |host_notes| with raw database values and passes them to the shell, enabling command injection. An attacker with authenticated access and graph management privileges can inject shell metacharacters into the notes field, create a graph template referencing |host_notes|, and trigger arbitrary command execution on the server when the graph is rendered. The vulnerability is traced through host.php (device save handler), lib/variables.php (substitution engine), and lib/rrd.php (RRDtool invocation). A proof-of-concept exploit automates these steps.

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Discussion

Links cited in the discussion

AI analysisMachine-generated, updated 16 Jun 2026, 21:15 UTC

Public exploits and detectionGitHub proofs of concept

Technical details

References

Community reviews

Related threats