SQL Injection Vulnerability in Cacti Performance Management Framework
CVE-2026-39893

9.8CRITICAL

Key Information:

Vendor

Cacti

Status
Cacti
Vendor
CVE Published:
24 June 2026

What is CVE-2026-39893?

Cacti, an open-source performance and fault management framework, suffers from a SQL injection vulnerability due to unsanitized user input in the rfilter request variable. This flaw affects installations where guest access is enabled, allowing unauthenticated users to exploit the vulnerability and execute arbitrary SQL commands. The issue was rectified in version 1.2.31, prompting all users to upgrade to ensure system integrity and security.

Affected Version(s)

cacti < 1.2.31

References

https://github.com/Cacti/cacti/security/advisories/GHSA-6...
x_refsource_CONFIRM
https://github.com/Cacti/cacti/pull/7039
x_refsource_MISC

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.