CVE-2026-39897: Reflected XSS in Cacti html_auth_footer (v1.2.30 and Earlier)

Technical summary

CVE-2026-39897 is a reflected XSS flaw (CWE-79) residing in the html_auth_footer function of Cacti. The vulnerability stems from insufficient input sanitization of user-supplied data reflected back in the authentication footer HTML. Because the flaw is reflected rather than stored, it requires social engineering (a user clicking a malicious link) to trigger, but the network-accessible nature of Cacti deployments and the low complexity of exploitation make this a practical attack vector. The CVSS 3.1 score of 6.1 (MEDIUM) reflects network accessibility, no privilege requirements, and reliance on user interaction, balanced against limited impact scope (confidentiality and integrity, not availability).

Business impact

For organizations relying on Cacti for infrastructure monitoring, a successful XSS attack could compromise administrative accounts, disrupt monitoring visibility, or serve as a pivot point for lateral movement. While direct system compromise is unlikely, attackers gaining session access could modify monitoring thresholds, disable alerts, or exfiltrate performance data. The reputational cost of a compromised monitoring system can be significant, especially if alerting is disabled during an actual incident.

Affected systems

Cacti version 1.2.30 and all earlier versions are vulnerable. Any organization running an unpatched instance accessible over a network—whether internally or externally—faces risk. Common deployments include on-premises monitoring servers and cloud-hosted monitoring solutions. Docker containers and virtual appliances running affected versions are equally at risk.

Exploitability

Exploitation requires no special privileges and can be performed by an unauthenticated attacker. However, the reflected nature of the XSS means a victim must click a crafted link (typically delivered via email, chat, or social media). The attack is not wormable or self-propagating. The barrier to exploitation is low—an attacker needs only to construct a URL with malicious JavaScript and trick a user into clicking it. No advanced exploit kit or zero-day research is required.

Remediation

Upgrade Cacti to version 1.2.31 or later. Organizations unable to patch immediately should implement network segmentation to restrict access to Cacti interfaces to trusted administrative networks only, enforce strict Content Security Policy (CSP) headers to mitigate XSS impact, and educate users to avoid clicking suspicious links from untrusted sources. Input validation and output encoding hardening should be verified in the deployment.

Patch guidance

Cacti administrators should prioritize upgrading to version 1.2.31 or the latest available release. Before patching, back up configuration and database files. Test the upgrade in a non-production environment first to ensure compatibility with custom plugins or integrations. Verify that all plugin and data sources continue to function post-upgrade. Cacti's official documentation and GitHub repository provide release notes and installation instructions. If in-place upgrade is not feasible, consider a parallel deployment and gradual cutover.

Detection guidance

Monitor web server and application logs for anomalous query strings in authentication-related URLs, particularly those containing JavaScript keywords (script, onerror, onclick, etc.) or encoded payloads. Implement Web Application Firewalls (WAF) rules to block XSS patterns in URL parameters. Endpoint Detection and Response (EDR) tools may flag unexpected JavaScript execution originating from the browser context of Cacti sessions. Hunt for signs of session hijacking, such as logins from unexpected IP addresses or time-of-day anomalies. Network monitoring should flag outbound connections initiated by the Cacti service itself, which would be abnormal.

Why prioritize this

Although this vulnerability carries a MEDIUM CVSS score and is not yet tracked in CISA's KEV catalog, it warrants timely patching because (1) Cacti is commonly deployed in critical infrastructure monitoring roles, (2) the attack vector is network-based and requires no authentication, (3) compromised monitoring can mask ongoing attacks, and (4) administrative accounts are the typical target of XSS in monitoring platforms. Organizations with internet-facing Cacti instances should prioritize this higher; internal-only deployments can follow standard patching cadence.

Risk score, explained

The CVSS 3.1 score of 6.1 reflects a Medium severity: the vulnerability is network-accessible (AV:N) with low attack complexity (AC:L) and no privilege requirements (PR:N), but requires user interaction (UI:R) and has a changed scope (S:C). Impact is limited to confidentiality and integrity (C:L, I:L) with no availability impact (A:N). The score appropriately captures that while exploitation is feasible and could compromise a session, the attack is not a system-wide outage risk. However, the context of Cacti's monitoring role argues for treating it as higher priority than the numerical score alone might suggest.

Frequently asked questions