CVE-2026-39938

CRITICAL

Cacti: Unauthenticated RCE on Graph Image

Title source: cna
STIX 2.1

Exploitation Summary

EIP tracks 2 public exploits for CVE-2026-39938. PoCs published by Polosss, kx00007.

AI-analyzed exploit summary This repository provides a detailed technical analysis of CVE-2026-39938, an unauthenticated Local File Inclusion (LFI) vulnerability in Cacti <= 1.2.30. It includes root cause analysis, vulnerable vs. patched code comparison, and step-by-step PoC instructions for exploitation.

Description

Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior have unauthenticated LFI through graph_theme and rrdtool IPC serialization hardening. This issue has been resolved in version 1.2.31.

Exploits (2)

github WRITEUP
by Polosss · poc
https://github.com/Polosss/By-Poloss..-..CVE-2026-39938

This repository provides a detailed technical analysis of CVE-2026-39938, an unauthenticated Local File Inclusion (LFI) vulnerability in Cacti <= 1.2.30. It includes root cause analysis, vulnerable vs. patched code comparison, and step-by-step PoC instructions for exploitation.

Classification
Writeup 100%
Attack Type
Info Leak
Complexity
Trivial
Reliability
Reliable
Target: Cacti <= 1.2.30
No auth needed
Prerequisites: Access to the target Cacti instance
mistral-large-3 · analyzed Jun 26, 2026 Full analysis →
nomisec WRITEUP
by kx00007 · poc
https://github.com/kx00007/CVE-2026-39938

Technical analysis of CVE-2026-39938, an unauthenticated RCE vulnerability in Cacti ≤1.2.30. The writeup details a path traversal (LFI) via the `graph_theme` parameter leading to OS command injection through `cacti_escapeshellarg()` on Windows, with root cause analysis, vulnerable code paths, and PoC examples.

Classification
Writeup 99%
Attack Type
Rce
Complexity
Trivial
Reliability
Reliable
Target: Cacti ≤1.2.30
No auth needed
Prerequisites: Cacti running on Windows · Guest account enabled (default in many setups) · At least one graph exists in the system · RRDtool installed (required by Cacti)
mistral-large-3 · analyzed Jul 12, 2026 Full analysis →

References (2)

Core 2

Scores

CVSS v3 9.8
EPSS 0.0131
EPSS Percentile 67.7%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact total

Details

CWE
CWE-22 CWE-78
Status published
Products (2)
cacti/cacti < 1.2.31
Cacti/cacti < 1.2.31
Published Jun 24, 2026
Tracked Since Jun 25, 2026