CVE-2026-39902
Description
A flaw was found in Cacti. This vulnerability allows an authenticated attacker with administrative privileges to execute arbitrary commands on the underlying host system. An incomplete character blocklist fails to properly restrict shell metacharacters—such as quotes, redirect operators, and subshell syntax—allowing validation checks on input strings to be bypassed.
Statement
Red Hat has rated this vulnerability as having an Important impact rather than Critical because exploitation is contingent on possessing elevated administrative credentials within Cacti, preventing unauthenticated remote attackers from abusing the flaw directly. However, once authenticated with administrative privileges, an attacker can circumvent input sanitization checks to execute arbitrary shell commands within the web application environment. This presents a serious threat to confidentiality, integrity, and availability by potentially allowing complete takeover of the hosting operating system.
Mitigation
--- CME Mitigation Guidance (2026-11-02) ---
Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.
The highest-value action is to replace shell execution with shell-free process spawning via proc_open() and enforce strict input string validation in Cacti: upgrade to Cacti 1.2.31 (or the fixed Cacti builds), which expand the character blocklist in cacti_input_string_is_safe() and introduce shell-free execution helpers using proc_open(), closing all 3 injection vectors (crafted input_string containing single or double quotes, crafted input_string containing redirection operators, crafted input_string containing subshell parentheses or braces). Until patched, this is a concern on Cacti deployments where users hold authenticated administrative privileges, so restrict administrative access to the Cacti web interface, audit administrative privileges, and monitor data input template configuration changes. As a compensating measure, deploy a Web Application Firewall to inspect incoming HTTP requests for command injection payloads containing subshells, quotes, and redirection operators, use an Endpoint Detection and Response agent to detect and terminate unauthorized shell execution or malicious child processes spawned by the web application, configure the Linux audit subsystem to log execve syscalls and unexpected process executions initiated by the web application worker, use Falco or eBPF runtime monitoring to detect anomalous shell invocations and command execution spawned by the Cacti web server process, and integrate Cacti administrative event logging with a SIEM to record configuration changes containing injected input strings. These controls limit blast radius and contain exploitation, but they do not fix the underlying incomplete character blocklist defect — apply the upstream patch to fully remediate.
Highest-impact CME: CME-1307 Command Injection Prevention (No Shell Invocation) (high)
Understanding the Weakness (CWE)
Confidentiality,Integrity,Availability,Non-Repudiation
Technical Impact: Execute Unauthorized Code or Commands; DoS: Crash, Exit, or Restart; Read Files or Directories; Modify Files or Directories; Read Application Data; Modify Application Data; Hide Activities
Attackers could execute unauthorized operating system commands, which could then be used to disable the product, or read and modify data for which the attacker does not have permissions to access directly. Since the targeted application is directly executing the commands instead of the attacker, any malicious activities may appear to come from the application or the application's owner.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
