CVE-2026-40082

🗓️ 25 Jun 2026 22:33:45Reported by GitHub_MType

cve🔗 web.nvd.nist.gov👁 21 Views🌐 WEB

Cacti prior to 1.2.31 has session fixation after login due to missing session_regenerate_id.

Reporter	Title	Published	Views	Family All 16
freebsd	cacti -- multiple vulnerabilities	16 Jun 202600:00	–	freebsd
attackerkb	CVE-2026-40082	25 Jun 202622:33	–	attackerkb
alpinelinux	CVE-2026-40082	25 Jun 202622:33	–	alpinelinux
bdu_fstec	The vulnerability of the session_regenerate_id() function in the Cacti network monitoring tool allows a malicious actor to perform unauthorized actions under the identity of another user.	2 Jul 202600:00	–	bdu_fstec
cvelist	CVE-2026-40082 Cacti: Session Fixation via missing session_regenerate_id() after login	25 Jun 202622:33	–	cvelist
debiancve	CVE-2026-40082	25 Jun 202622:33	–	debiancve
euvd	EUVD-2026-39586	25 Jun 202622:33	–	euvd
nessus	FreeBSD : cacti -- multiple vulnerabilities (9647af6d-7a05-11f1-99fc-40b034429ecf)	9 Jul 202600:00	–	nessus
nessus	Linux Distros Unpatched Vulnerability : CVE-2026-40082	30 Jun 202600:00	–	nessus
nvd	CVE-2026-40082	25 Jun 202623:17	–	nvd

NVD

Vulners

Node

cacti cactiRange<1.2.31

[
  {
    "vendor": "Cacti",
    "product": "cacti",
    "versions": [
      {
        "version": "< 1.2.31",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/Cacti/cacti/security/advisories/GHSA-273r-qr93-wgcp
github	www.github.com/Cacti/cacti/releases/tag/release%2F1.2.31
github	www.github.com/Cacti/cacti/commit/2fa404e70a5702be10682555911228e8e51ba198

Parameter	Position	Path	Description	CWE
username	request body	auth_login.php	Session fixation due to missing session_regenerate_id() after login in auth_login.php	CWE-384
password	request body	auth_login.php	Session fixation due to missing session_regenerate_id() after login in auth_login.php	CWE-384

29 Jun 2026 18:50Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.15.4

EPSS0.00183

SSVC

CWE-384