CVE-2026-40079 is a critical command injection flaw in Cacti 1.2.30 and earlier, scored CVSS 9.8. The escape_command function in lib/rrd.php returns its input unchanged, so graph template values can reach a shell. Cacti 1.2.31 fixes it. Upgrade, then review who can edit graph templates.
What's affected
Per the NVD record and the Cacti GitHub advisory:
- Affected: Cacti 1.2.30 and earlier
- Fixed: Cacti 1.2.31
The advisory calls this an internal audit finding by the Cacti security team. It describes the status as partially fixed before this release: the rrdtool_function_tune path had been fixed earlier by wrapping parameters in an escaping helper, but the graph rendering path in __rrd_execute still sent values to shell_exec. The advisory says text_format values from graph templates, which may carry host variable substitutions, are the residual risk.
How to check if you're exposed
Find your Cacti version. The version is shown in the web interface, and package installs can be queried:
dpkg -l cacti
rpm -q cacti
If you run Cacti from a source checkout or a container image, check the tag or the version file in the install directory, and compare it with 1.2.31.
If you are on 1.2.30 or earlier, review which accounts can create or change graph templates and host settings, since the advisory points at template values as the input that reaches the command line. Check the web server and Cacti logs for unexpected template edits.
What to do now
- Inventory every Cacti instance, including old monitoring servers that nobody owns.
- Upgrade to 1.2.31 or later following the Cacti upgrade guide, and back up the database first.
- Limit graph template and device edit permissions to the people who need them.
- Keep the Cacti web interface off the public internet if it does not need to be there, and place it behind a VPN or access proxy.
- Review recent changes to graph templates for anything you did not expect.
- If you cannot upgrade today, treat the server as exposed and reduce who can reach it.
Why it matters
The weakness is CWE-78, OS command injection, with the related CWE-88, argument injection. The root cause in the advisory is blunt: the function meant to escape a command line does nothing, and the string is then passed to a shell. Anything that can influence the string can influence what the shell runs.
Monitoring tools are a good target because they hold credentials to many devices and sit inside the network. A flaw like this turns one web application into a foothold. The advisory suggests defaulting to the pipe path, which does not invoke a shell, and auditing every value that flows into the command line. The NVD record does not flag it as exploited in the wild.
The CVSS vector reads network reachable, low complexity, no privileges. Advisory text and the vector do not fully agree on what an attacker must be able to edit, so use the fixed release as your answer and not a careful reading of preconditions.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Which version fixes CVE-2026-40079?
Cacti 1.2.31, per the advisory and the NVD record.
Is it exploited in the wild?
The KEV flag is false in the record and the advisory does not report exploitation.
Sources
Last reviewed: 19 October 2026.
