Risk Letters

Exploited vulnerability

CVE-2026-39949

TLP:CLEAR

Cacti Authenticated Remote Code Execution via Host Variable Injection

Cacti ≤ 1.2.30 has an authenticated OS command injection flaw. Users with device and graph template creation privileges can put shell metacharacters in a device’s notes field. Cacti’s variable replacement engine inserts that field, unsanitized, into RRDtool command-line arguments through the |host_notes| variable. When a graph built from a template using that variable is rendered, the injected commands run on the server as the web server user, giving full remote code execution.

Facts

  • Vendor: The Cacti Group
  • Product: Cacti
  • First known exploitation: 14 October 2026
  • First seen by Risk Letters: 14 October 2026

Members see which Nordic sectors the flaw hits, and what to do about it.

Get the full brief

Data: NVD (public domain), CISA KEV, FIRST EPSS, MITRE ATT&CK, AlienVault OTX. NVD