Quick answers
- Is CVE-2026-39893 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-39893 being exploited in the wild.
- How severe is CVE-2026-39893?
- Critical severity, with a CVSS score of 9.8, published 24 June 2026.
- Which products and versions are affected?
- Cacti <= 1.2.30.
- Is there a fix for CVE-2026-39893?
- A patch was published on 2026-04-26: Fix merged into 1.2.x branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-39893 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-39893?
- Check whether you run Cacti at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A SQL injection vulnerability exists in `graph_view.php` within Cacti versions 1.2.30 and prior. The `rfilter` request parameter is concatenated directly into an `RLIKE` SQL clause without proper sanitization or parameterization. Because Cacti often supports guest access for graph viewing, this endpoint can be reached by unauthenticated attackers over the network if guest access is enabled. An attacker can exploit this to execute arbitrary SQL queries, potentially leading to full database compromise (Confidentiality, Integrity, and Availability impact). The issue was resolved in version 1.2.31 by implementing the `db_qstr_rlike()` helper function to sanitize input and enforce length limits.
Affected products
- Cacti Cacti <= 1.2.30
Timeline
- 2026-04-17: other: Internal audit completed by Cacti team
- 2026-04-26: patched: Fix merged into 1.2.x branch
- 2026-06-19: advisory: GitHub Security Advisory published
- 2026-06-24: disclosed: CVE published to NVD