CVE-2026-39938: Cacti: Unauthenticated RCE on Graph Image

Synopsis

An unauthenticated remote code execution vulnerability exists in Cacti, an open source performance and fault management framework, affecting versions 1.2.30 and earlier. The flaw is reachable over the network with no credentials required and no user interaction needed, arising from a local file inclusion weakness in graph_theme combined with insufficient hardening of rrdtool IPC serialization. Successful exploitation gives an attacker full read, write, and execution capability on the host running Cacti. Note: the description states this was resolved in version 1.2.31, but no fix version has been formally published in the advisory record; HarborGuard is tracking the advisory for confirmed patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network, so an attacker must be able to reach the Cacti service on its listening port from a remote host.

• AuthenticationNot required

  No account or session token is needed; the vulnerable code path is reachable by any unauthenticated HTTP request.

• Victim interactionNot required

  Exploitation is fully server-side and requires no action from any logged-in user or administrator.

• Attack complexityDetail

  The exploit is reliable and condition-free, requiring no race conditions, specific memory layout, or environmental prerequisites.

Blast Radius

• An attacker achieves remote code execution and can run arbitrary commands as the Cacti process user on the host.
• All data readable by that process, including stored credentials, API keys, and monitored device configurations, is exposed.
• An attacker can write or overwrite files accessible to the process, including Cacti configuration files and web-accessible scripts.
• The Cacti service and any co-located processes can be crashed or rendered unavailable.