CVE-2026-39938

—

CVSS 3.1

9.8 critical

EPSS

<1%p51

Published

Jun 24, 2026 (Jun 24, 2026)

Modified

Jun 26, 2026

Description

Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior have unauthenticated LFI through graph_theme and rrdtool IPC serialization hardening. This issue has been resolved in version 1.2.31.

Vendors: cacti
Products: cacti
Weakness: CWE-22, CWE-78
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (0.7%)

In the news0 stories

No ingested article mentions this CVE yet.