CVE-2026-39955

Executive Summary

CVE-2026-39955 is a critical pre-authentication SQL Injection vulnerability in Cacti, an open-source performance and fault management framework. The vulnerability resides in the graph_view.php file, where an unanchored regular expression filter (FILTER_VALIDATE_REGEXP) allows an attacker to inject arbitrary SQL commands without requiring any authentication. This flaw affects all versions up to and including 1.2.30. The CVSS score of 9.8 reflects the ease of exploitation (network-based, low complexity, no privileges required) and the severe impact on confidentiality, integrity, and availability. The vulnerability has been patched in version 1.2.31. Given the public availability of proof-of-concept code and the critical nature of the flaw, immediate patching is strongly recommended.

Supply Chain & Package Security

Cacti is a PHP-based application typically deployed via tarball or package managers (e.g., apt, yum). The vulnerability is in the core source code, not in a third-party package. However, organizations using Cacti should verify the integrity of their installation and ensure they are sourcing the application from official repositories or the Cacti website. The patch is a direct code fix, not a dependency update.

CVSS Breakdown & Threat Level

• CVSS Score: 9.8 (Critical)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

Threat Level: Critical. The vulnerability allows unauthenticated remote attackers to execute arbitrary SQL commands, potentially leading to complete compromise of the Cacti database, including user credentials, device configurations, and performance data. This can be a stepping stone for lateral movement within the network.

Deep Dive & Mechanics

The vulnerability is located in graph_view.php. The code uses FILTER_VALIDATE_REGEXP to validate user-supplied input, but the regular expression pattern is not anchored. This means the pattern can match anywhere within the input string, allowing an attacker to inject SQL syntax that bypasses the intended validation.

Specifically, the vulnerable code likely looks similar to:

$filter = filter_input(INPUT_GET, 'filter', FILTER_VALIDATE_REGEXP, array('options' => array('regexp' => '/^[a-zA-Z0-9_]+$/')));

Because the regex is not anchored with ^ and $ (or is improperly anchored), an attacker can supply a value like valid_string' OR '1'='1. The regex will match the valid_string portion, and the rest of the input is passed to the SQL query, resulting in injection.

The unanchored regex allows the attacker to prepend or append malicious SQL fragments to an otherwise valid string. This bypasses the intended input sanitization and leads to SQL injection.

Vulnerable vs. Patched Code

Vulnerable Code (1.2.30 and prior):

// graph_view.php (simplified)
$filter = filter_input(INPUT_GET, 'filter', FILTER_VALIDATE_REGEXP, array('options' => array('regexp' => '/[a-zA-Z0-9_]+/')));
$sql = "SELECT * FROM graph_templates WHERE name LIKE '%$filter%'";
$result = db_query($sql);

Patched Code (1.2.31):

// graph_view.php (simplified)
$filter = filter_input(INPUT_GET, 'filter', FILTER_VALIDATE_REGEXP, array('options' => array('regexp' => '/^[a-zA-Z0-9_]+$/')));
if ($filter !== false) {
    $sql = "SELECT * FROM graph_templates WHERE name LIKE '%" . db_escape($filter) . "%'";
    $result = db_query($sql);
} else {
    // Handle invalid input
}

The patch adds proper anchoring (^ and $) to the regex and uses a database escaping function (db_escape()) to further sanitize the input.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A target running Cacti version 1.2.30 or earlier.
• Network access to the Cacti web interface.

Exploitation Steps:

1. Identify the vulnerable endpoint: http://target/cacti/graph_view.php?filter=INJECTION_POINT
2. Craft a payload that bypasses the unanchored regex. For example, to extract the database version:

   http://target/cacti/graph_view.php?filter=valid' UNION SELECT @@version,2,3-- -
   

3. The regex /[a-zA-Z0-9_]+/ will match valid, and the rest of the payload will be injected into the SQL query.
4. Use SQL injection techniques to enumerate tables, extract user credentials, or execute system commands (if the database user has sufficient privileges).

Example Payloads:

• Extract user credentials:

  http://target/cacti/graph_view.php?filter=valid' UNION SELECT username,password,3 FROM user_auth-- -
  

• Blind SQL injection (time-based):

  http://target/cacti/graph_view.php?filter=valid' AND SLEEP(5)-- -
  

Blue Team

Detection and Response:

1. Monitor Web Logs: Look for requests to graph_view.php with unusual filter parameters containing SQL keywords (e.g., UNION, SELECT, SLEEP).
2. Database Monitoring: Enable query logging and monitor for unexpected SQL queries originating from the Cacti application.
3. Network Segmentation: Isolate Cacti servers from critical internal networks to limit lateral movement.
4. Web Application Firewall (WAF): Deploy rules to block SQL injection patterns in the filter parameter.
5. Immediate Patching: Upgrade to Cacti 1.2.31 or apply the vendor-provided patch.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /cacti/graph_view.php with a filter parameter containing SQL keywords (e.g., UNION, SELECT, OR, AND, SLEEP).
  • Unusual database queries from the Cacti web server IP.
• File IOCs:
  • Modified graph_view.php file (if attacker attempts to backdoor).
  • Suspicious files in the Cacti web root (e.g., webshells).
• System IOCs:
  • Unexpected database user activity.
  • New user accounts in the Cacti database.
  • Unusual outbound connections from the Cacti server.

Detection Engineering

YARA Rule

rule CVE_2026_39955_Cacti_SQLi {
    meta:
        description = "Detects Cacti graph_view.php files vulnerable to CVE-2026-39955"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-39955"
    strings:
        $vuln_regex = /FILTER_VALIDATE_REGEXP.*\/\[a-zA-Z0-9_\]+\//
        $safe_regex = /FILTER_VALIDATE_REGEXP.*\/\^\[a-zA-Z0-9_\]+\$\//
    condition:
        $vuln_regex and not $safe_regex
}

Sigma Rule

title: Cacti SQL Injection via graph_view.php (CVE-2026-39955)
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects SQL injection attempts against Cacti graph_view.php
author: Valters IT
date: 2026-01-01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        c-uri|contains: '/graph_view.php'
        cs-uri-query|contains: 
            - 'filter='
            - 'UNION'
            - 'SELECT'
            - 'SLEEP'
            - 'OR '
            - 'AND '
    condition: selection
falsepositives:
    - Legitimate use of the filter parameter with SQL keywords in data
level: high

Suricata Rule

alert http any any -> any any (msg:"Cacti SQL Injection Attempt (CVE-2026-39955)"; flow:to_server,established; content:"GET"; http_method; content:"/graph_view.php"; http_uri; content:"filter="; http_uri; pcre:"/filter=[^&]*(UNION|SELECT|SLEEP|OR |AND )/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Patch: Upgrade Cacti to version 1.2.31 or later immediately.
2. Workaround: If patching is not possible, restrict access to graph_view.php using a web application firewall (WAF) or by modifying the web server configuration to require authentication.

Long-Term Mitigations:

1. Input Validation: Implement strict input validation using anchored regular expressions and parameterized queries.
2. Least Privilege: Ensure the database user used by Cacti has minimal privileges (e.g., no FILE or EXECUTE privileges).
3. Regular Updates: Keep Cacti and all dependencies up to date.
4. Security Monitoring: Deploy intrusion detection systems (IDS) and monitor logs for suspicious activity.

Valters IT Signature

This report was generated by Valters IT, an elite DevSecOps and Cyber Threat Intelligence team. For further assistance, contact us at valters@example.com.