CVE-2026-39902 Cacti: Authenticated RCE on Data Input

High 7.2 Published 23 Oct 2026 Updated 29 Oct 2026

Exploited in the wild: Not known
Fix: Available

What is CVE-2026-39902?

CVE-2026-39902 is a high-severity vulnerability in cacti, published on 23 Oct 2026.

Official description

Cacti is an open source performance and fault management framework. Prior to version 1.2.31, the prior blocklist ([;&| `$\\n\r]) omitted single-quote, double-quote, redirect operators, subshell parens and braces. An authenticated admin could save an input_string` containing single-quote, redirect operator, or subshell parens, and pass the check. This issue has been patched in version 1.2.31.

Weakness: CWE-78

Which versions are affected by CVE-2026-39902?

How do I fix CVE-2026-39902?

Upgrade to a fixed version.

Is CVE-2026-39902 being exploited?

There is no known exploitation of CVE-2026-39902 in the wild and no public exploit code.

Public exploit code: 1 proofs of concept on GitHub.

Sources

Also known as DEBIAN-CVE-2026-39902, GHSA-c4qp-j9r9-fq24, UBUNTU-CVE-2026-39902.