CVE-2026-40082: Cacti Session Fixation Vulnerability in Versions 1.2.30 and Earlier

Technical summary

The vulnerability stems from inadequate session management during authentication. In Cacti versions 1.2.30 and prior, the login handler (auth_login.php lines 203-207) sets the user session variable directly into $_SESSION[SESS_USER_ID] without calling session_regenerate_id(). This standard PHP function rotates the session identifier upon successful authentication, breaking the association between any pre-authentication session ID an attacker might have crafted and the authenticated user. The session cookie configuration at include/global.php lines 513-537 correctly implements httpOnly, SameSite=Strict, and secure flags for HTTPS contexts, but these defensive measures do not compensate for the absence of session ID rotation. Same-site attack vectors—such as tricking a user into visiting an attacker-controlled page within the same domain context, or exploiting certain cross-origin POST scenarios—can still succeed in fixing a session before the user logs in, then leveraging that fixed session post-authentication.

Business impact

This vulnerability enables attackers to maintain persistent, authenticated access to Cacti instances without knowledge of user credentials. Since Cacti is typically used for critical infrastructure monitoring and performance management, a hijacked administrative session could allow unauthorized access to network visibility, performance data, and potentially configuration changes. The impact is moderate (CVSS 5.4) because exploitation requires user interaction and the attack surface is restricted to users on the same site origin or leveraging same-site vectors. However, in multi-tenant or shared-hosting scenarios, or where Cacti monitors sensitive systems, the ability to impersonate authenticated users poses meaningful confidentiality and integrity risks.

Affected systems

Cacti versions 1.2.30 and earlier are vulnerable. Organizations running Cacti deployments should audit their current version against this baseline. Version 1.2.31 and later contain the remediation. The vulnerability does not appear on the CISA Known Exploited Vulnerabilities (KEV) catalog, suggesting active exploitation in the wild has not yet been reported or widely disclosed.

Exploitability

Exploitation requires user interaction (CVSS:AC:L/UI:R) and network access, but no privileged precondition. An attacker must socially engineer or trick a legitimate Cacti user into visiting a malicious page or performing an action that allows the attacker to pre-set a session cookie, then capture that session after the user authenticates. The attack is not trivial—it demands coordination and timing—but is feasible, particularly against users in less-security-aware environments. The absence from the KEV catalog suggests this attack pattern has not yet been operationalized at scale by known threat actors.

Remediation

Upgrade to Cacti version 1.2.31 or later immediately. This version includes the session_regenerate_id() call in the authentication flow, ensuring that upon successful login, the session identifier is rotated, invalidating any pre-authentication session fixation attempts. Organizations unable to upgrade immediately should implement network-level mitigations: enforce strict access controls to Cacti administrative interfaces, restrict Cacti to authenticated corporate networks or VPNs, and monitor for suspicious session behavior or multiple concurrent sessions from the same user.

Patch guidance

Verify the current Cacti version in your environment. Access the administrative interface, check the version number (usually visible in the footer or via the status page), or query the database schema version if available. Review the vendor's official release notes for version 1.2.31 to confirm it addresses CVE-2026-40082. Plan a maintenance window to upgrade, as Cacti may require brief service downtime. Test the upgrade in a non-production environment first if your deployment is critical. After patching, verify login functionality and monitor for any session-related anomalies during and after the rollout.

Detection guidance

Monitor Cacti logs for authentication events and session creation patterns. Alert on: multiple failed login attempts followed by successful authentication from different IP addresses or user-agents using the same session, sudden session activity spikes, or sessions that survive longer than expected authentication windows. Implement passive monitoring of session identifiers before and after login events—a session ID change post-authentication indicates proper remediation. In a forensic context, examine web server access logs and Cacti audit logs for evidence of session fixation attempts (e.g., crafted session IDs or anomalous session timing). If you detect suspicious activity, check the Cacti version and review any unauthorized configuration changes or data access.

Why prioritize this

Cacti is a foundational monitoring tool in many IT environments, often used to observe critical infrastructure. While the CVSS score is moderate (5.4) and exploitation requires user interaction, the potential for unauthorized administrative access to a system that sees and controls network visibility makes this a notable concern. Prioritization should reflect your reliance on Cacti: if it monitors business-critical systems, treat this as a higher priority. The availability of a tested patch (1.2.31) and the absence of active exploits provide a narrow window to upgrade before threat actors operationalize the flaw.

Risk score, explained

CVSS 3.1 score of 5.4 (MEDIUM) reflects a network-accessible vulnerability with low attack complexity and moderate impact on confidentiality and integrity (partial unauthorized access and potential modification). The requirement for user interaction (UI:R) and the constraint of same-site or cross-origin attack vectors prevent a higher score. The rating appropriately captures that this is a real risk requiring action, but not an emergency threatening all Cacti users immediately. Your organizational risk may be higher if Cacti is exposed to untrusted networks or if session hijacking would grant access to highly sensitive monitoring data.

Frequently asked questions