Is CVE-2026-40079 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-40079 being exploited in the wild.

How severe is CVE-2026-40079?

Informational severity, with a CVSS score of 8.6, published 25 June 2026.

Is there a fix for CVE-2026-40079?

A patch was published on 2026-06-25: Fixed in version 1.2.31 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-40079 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-40079?

Check whether you run Cacti at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-40079: Cacti command injection in RRDtool execution

CVE-2026-40079 · Severity: info · CVSS 8.6 · Published 2026-06-25

Cacti, an open-source network monitoring and fault management framework, is vulnerable to a security flaw that could allow an administrative user to execute unauthorized commands on the underlying server. This occurs because the system fails to properly sanitize certain text inputs used when generating performance graphs. An attacker with high-level privileges could exploit this to gain full control over the server, potentially leading to data theft or service disruption.

Technologies: Cacti. Vendors: Cacti.

Quick answers

Is CVE-2026-40079 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-40079 being exploited in the wild.
How severe is CVE-2026-40079?: Informational severity, with a CVSS score of 8.6, published 25 June 2026.
Which products and versions are affected?: Cacti <= 1.2.30.
Is there a fix for CVE-2026-40079?: A patch was published on 2026-06-25: Fixed in version 1.2.31 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-40079 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-40079?: Check whether you run Cacti at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A command injection vulnerability exists in Cacti's RRDtool execution path within `lib/rrd.php`. The `escape_command()` function, intended to sanitize shell commands, was implemented as a no-op that returns the input string unchanged. When `rrdtool_function_graph()` builds a command line, it incorporates `text_format` values from graph templates—which may include host variable substitutions—and passes them to `shell_exec()` via `__rrd_execute()` without adequate escaping. An attacker with sufficient privileges to modify graph templates or host variables can inject arbitrary OS commands. This issue is addressed in version 1.2.31 by implementing proper sanitization and hardening the command execution path.

Affected products

Cacti Cacti <= 1.2.30

Timeline

2026-06-19: advisory: GitHub Security Advisory GHSA-xq98-376r-hv9j published
2026-06-25: disclosed: CVE-2026-40079 published to NVD
2026-06-25: patched: Fixed in version 1.2.31

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.