CVE-2026-39893

This vulnerability lets someone “break into” Cacti’s database using a trick in a URL parameter for viewing graphs. If guest viewing is turned on, the attacker doesn’t need an account—so they may be able to read, change, or delete data that Cacti uses. Think of it like leaving a spare key under the mat and then finding a way to use that key to unlock the office computer and alter its files.

This matters if you run the open-source monitoring/app called Cacti and expose its graph viewing to unauthenticated (guest) users. The risk specifically requires that guest viewing is enabled in Cacti’s configuration; otherwise the pre-auth path may not be reachable. It’s most relevant for systems reachable over the network where guest access can be used.

This is an AMBER issue because it is pre-authentication: an attacker can reach the vulnerable feature without logging in if guest viewing is enabled. While there’s no KEV listing and no public exploit code noted, the impact includes the ability to read or modify database contents, so you should upgrade promptly.