Loading story…
Cacti disclosed a critical unauthenticated local file inclusion flaw, tracked as CVE-2026-39938 and GHSA-rm7p-qcqm-x5m6, affecting versions up to and including 1.2.30. The issue stems from the graph_theme parameter and can be exploited over the network without privileges or user interaction, earning a CVSS 3.1 score of 9.8. The advisory also notes related hardening for rrdtool IPC serialization, with the weakness associated with path traversal and potential OS command injection concerns.
An earlier security change in the 1.2.x branch sanitized graph_theme with PHP basename() and rejected empty, . and .. values in lib/rrd.php, falling back to the selected theme when input was invalid. Cacti later determined that approach was bypassable and replaced it with stronger filesystem allowlist validation in cacti_validate_theme(). The vendor fixed the vulnerability in 1.2.31, making that release the recommended upgrade target for exposed deployments.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
GitHub published security advisory GHSA-rm7p-qcqm-x5m6 for Cacti, tracking CVE-2026-39938 and describing an unauthenticated local file inclusion issue via `graph_theme`. The advisory said the earlier `basename()`-based fix was bypassable and that stronger allowlist validation in `cacti_validate_theme()` was used in the 1.2.31 patch.
A Cacti commit authored by Thomas Vincent implemented a security fix to sanitize the `graph_theme` parameter with `basename()` and reject invalid values to prevent local file inclusion. The change was associated with release 1.2.31 in the `1.2.x` branch.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
github.com
Open sourcegithub.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A high-severity blind SQL injection vulnerability tracked as **`CVE-2026-71287`** was disclosed in **Cacti**, where insufficient sanitization in the `sanitize_sql_column()` function allows attacker-controlled input to reach raw `ORDER BY` clauses. The flaw affects multiple pages, including `user_log.php`, `utilities.php`, `user_domains.php`, and `user_group_admin.php`, through the `sort_column` GET parameter. Because the regex-based allowlist still permits characters needed for SQL time-delay functions, an authenticated user can trigger time-based blind SQL injection against the Cacti database. The issue was assigned a **CVSS 3.1 score of 8.8** and mapped to **`CWE-89`**, with exploitation possible by any authenticated Cacti account regardless of privilege level. Activity in the upstream **Cacti** GitHub repository shows broader security remediation work around SQL injection and `ORDER BY` parameter sanitization, alongside other hardening changes, indicating the project is actively addressing input-validation weaknesses and related web application security risks in the codebase.
Aug 6, 2026
Cisco released emergency fixes for two **critical (CVSS 10.0)** vulnerabilities in its firewall management software that could allow **remote, unauthenticated attackers** to execute code and gain **root-level** access to the underlying operating system. The issues are tracked as `CVE-2026-20079` and `CVE-2026-20131`, and reporting emphasized the risk profile given Cisco’s widespread deployment in large enterprises and the historical interest of sophisticated actors in rapidly weaponizing Cisco bugs. Available reporting stated there were **no confirmed in-the-wild exploitation** reports at the time of publication, but urged rapid patching due to the combination of unauthenticated reachability and full compromise potential. Separate coverage packaged the Cisco flaws alongside other weekly security items (e.g., Tycoon2FA infrastructure takedown and other incidents), but the Cisco item consistently described the same two maximum-severity firewall management vulnerabilities and their impact (RCE leading to root access).
Jun 29, 2026
GLPI, the open-source IT asset and service management platform, patched two high-severity vulnerabilities in version `11.0.6`. The first, `CVE-2026-26263`, is an **unauthenticated time-based blind SQL injection** in the product's Search engine that affects versions `11.0.0` through before `11.0.6`. The flaw is classified as `CWE-89` and could expose or alter sensitive data and impact availability. The same release also fixes `CVE-2026-26026`, a **server-side template injection** issue caused by double compilation that affects the same version range. That flaw, mapped to `CWE-94` and `CWE-1336`, allows an administrator to trigger template injection that can lead to **remote code execution**. Both issues were disclosed through GitHub security advisories, and organizations running GLPI `11.0.0` to `11.0.5` should upgrade to `11.0.6` to remediate the vulnerabilities.
Jun 29, 2026