CVE-2026-39902

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-39902", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-04-07T20:32:03.012Z", "datePublished": "2026-10-23T14:42:45.710Z", "dateUpdated": "2026-10-29T14:04:38.453Z"}, "containers": {"cna": {"title": "Cacti: Authenticated RCE on Data Input", "problemTypes": [{"descriptions": [{"cweId": "CWE-78", "lang": "en", "description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/Cacti/cacti/security/advisories/GHSA-c4qp-j9r9-fq24", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/Cacti/cacti/security/advisories/GHSA-c4qp-j9r9-fq24"}, {"name": "https://github.com/Cacti/cacti/pull/7112", "tags": ["x_refsource_MISC"], "url": "https://github.com/Cacti/cacti/pull/7112"}], "affected": [{"vendor": "Cacti", "product": "cacti", "versions": [{"version": "< 1.2.31", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-10-23T14:42:45.710Z"}, "descriptions": [{"lang": "en", "value": "Cacti is an open source performance and fault management framework. Prior to version 1.2.31, the prior blocklist ([;&| `$\\\\n\\r]) omitted single-quote, double-quote, redirect operators, subshell parens and braces. An authenticated admin could save an input_string` containing single-quote, redirect operator, or subshell parens, and pass the check. This issue has been patched in version 1.2.31."}], "source": {"advisory": "GHSA-c4qp-j9r9-fq24", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-29T14:02:26.331320Z", "id": "CVE-2026-39902", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-29T14:04:38.453Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-39902", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-29T14:02:26.331320Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-29T14:03:48.489Z"}}], "cna": {"title": "Cacti: Authenticated RCE on Data Input", "source": {"advisory": "GHSA-c4qp-j9r9-fq24", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "Cacti", "product": "cacti", "versions": [{"status": "affected", "version": "< 1.2.31"}]}], "references": [{"url": "https://github.com/Cacti/cacti/security/advisories/GHSA-c4qp-j9r9-fq24", "name": "https://github.com/Cacti/cacti/security/advisories/GHSA-c4qp-j9r9-fq24", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/Cacti/cacti/pull/7112", "name": "https://github.com/Cacti/cacti/pull/7112", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Cacti is an open source performance and fault management framework. Prior to version 1.2.31, the prior blocklist ([;&| `$\\\\n\\r]) omitted single-quote, double-quote, redirect operators, subshell parens and braces. An authenticated admin could save an input_string` containing single-quote, redirect operator, or subshell parens, and pass the check. This issue has been patched in version 1.2.31."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-78", "description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-10-23T14:42:45.710Z"}}}, "cveMetadata": {"cveId": "CVE-2026-39902", "state": "PUBLISHED", "dateUpdated": "2026-10-29T14:04:38.453Z", "dateReserved": "2026-04-07T20:32:03.012Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-10-23T14:42:45.710Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "cacti", "vendor": "Cacti", "versions": [{"status": "affected", "version": "< 1.2.31"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Cacti is an open source performance and fault management framework. Prior to version 1.2.31, the prior blocklist ([;&| `$\\\\n\\r]) omitted single-quote, double-quote, redirect operators, subshell parens and braces. An authenticated admin could save an input_string` containing single-quote, redirect operator, or subshell parens, and pass the check. This issue has been patched in version 1.2.31."}], "id": "CVE-2026-39902", "lastModified": "2026-10-29T14:17:54.903", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 5.9, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-39902", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-29T14:02:26.331320Z", "version": "2.0.3"}}]}, "published": "2026-10-23T15:17:30.873", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/Cacti/cacti/pull/7112"}, {"source": "security-advisories@github.com", "url": "https://github.com/Cacti/cacti/security/advisories/GHSA-c4qp-j9r9-fq24"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-78"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "cacti: Cacti: Arbitrary command execution via incomplete character blocklist", "id": "2559925", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2559925"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.2", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-78", "details": ["Cacti is an open source performance and fault management framework. Prior to version 1.2.31, the prior blocklist ([;&| `$\\\\n\\r]) omitted single-quote, double-quote, redirect operators, subshell parens and braces. An authenticated admin could save an input_string` containing single-quote, redirect operator, or subshell parens, and pass the check. This issue has been patched in version 1.2.31.", "A flaw was found in Cacti. This vulnerability allows an authenticated attacker with administrative privileges to execute arbitrary commands on the underlying host system. An incomplete character blocklist fails to properly restrict shell metacharacters\u2014such as quotes, redirect operators, and subshell syntax\u2014allowing validation checks on input strings to be bypassed."], "name": "CVE-2026-39902", "public_date": "2026-10-23T14:42:45Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-39902\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-39902\nhttps://github.com/Cacti/cacti/pull/7112\nhttps://github.com/Cacti/cacti/security/advisories/GHSA-c4qp-j9r9-fq24"], "statement": "Red Hat has rated this vulnerability as having an Important impact rather than Critical because exploitation is contingent on possessing elevated administrative credentials within Cacti, preventing unauthenticated remote attackers from abusing the flaw directly. However, once authenticated with administrative privileges, an attacker can circumvent input sanitization checks to execute arbitrary shell commands within the web application environment. This presents a serious threat to confidentiality, integrity, and availability by potentially allowing complete takeover of the hosting operating system.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.2.31)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "cacti", "source": "cna", "vendor": "Cacti"}, "product": "cacti", "vendor": "cacti"}], "created": "2026-10-23T17:15:07.222875+00:00", "updated": "2026-10-23T23:45:03.140436+00:00", "vendors": ["cacti", "cacti$PRODUCT$cacti"]}