Stored SQL Injection in Cacti Performance Management Framework
CVE-2026-39951

7.6HIGH

Key Information:

Vendor

Cacti

Status
Cacti
Vendor
CVE Published:
24 June 2026

What is CVE-2026-39951?

Cacti, an open source performance and fault management framework, is susceptible to a Stored SQL Injection vulnerability that affects versions 1.2.30 and earlier through the graph_name_regexp parameter within its Reports feature. This issue could allow attackers to manipulate SQL queries executed by the application, potentially compromising the integrity and confidentiality of the underlying database. The vulnerability has been addressed in version 1.2.31, which is strongly recommended for users to protect against exploitation. For more details and mitigation steps, please refer to the official security advisory.

Affected Version(s)

cacti < 1.2.31

References

https://github.com/Cacti/cacti/security/advisories/GHSA-p...
x_refsource_CONFIRM
https://github.com/Cacti/cacti/commit/4c09efaebf3a9faec66...
x_refsource_MISC

CVSS V3.1

Score:
7.6
Severity:
HIGH
Confidentiality:
High
Integrity:
Low
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.