CVE-2026-39894
Cacti ≤ 1.2.31
Raw vector
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:NSummary
CVE-2026-39894 is a low-severity Use of Function with Inconsistent Implementations (CWE-474) vulnerability in Cacti Cacti. Its CVSS base score is 2.9 (Low).
Operationally, ranked at the 4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SA-15 (Development Process, Standards, and Tools) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-39132
Vulnerability Data
Cacti is an open source performance and fault management framework. In versions 1.2.30 and below, the locale-dependent decimal formatting in rrdtool_function_update() can corrupt RRDtool metric values. The rrdtool_function_update() function checks metric values with is_numeric() and concatenates them into the RRDtool…
more
update command via PHP string interpolation. PHP's string cast of floats is locale-sensitive: if LC_NUMERIC uses comma as decimal separator (e.g., de_DE), a value of 1.5 becomes "1,5". RRDtool expects . as decimal separator, causing metric data to shift into wrong columns or be silently dropped. No setlocale() reset is present in the update path. This causes a data integrity issue, but is not remotely exploitable; it requires server locale misconfiguration. The issue has been fixed in version 1.2.31.
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Developer testing across OS versions can reveal behavioral differences caused by the inconsistent function.
Documented development standards and tools can prohibit or replace functions known to have inconsistent implementations.
Engineering principles can require use of portable, consistently implemented functions across platforms.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly enforce coding standards and portability reviews that avoid functions with inconsistent behavior across platforms.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can surface cross-platform inconsistencies but does not prevent their introduction in code.
Secure SDLC requires consistent API selection and platform abstraction, reducing use of inconsistently implemented functions.
Secure architecture principles include portable abstractions and avoiding platform-specific calls with divergent behavior.
Secure coding standards explicitly prohibit or wrap functions known to behave differently across OSes and versions.