CVE-2026-40082: 
Cacti vulnerability analysis and mitigation

CVE-2026-40082 is a Session Fixation vulnerability in Cacti, an open-source performance and fault management framework, caused by a missing call to session_regenerate_id() after successful login. All versions up to and including 1.2.30 are affected; the issue was fixed in version 1.2.31. The vulnerability was published on June 25, 2026, with the GitHub Security Advisory (GHSA-273r-qr93-wgcp) published on June 18, 2026. It carries a CVSS v3.1 base score of 5.4 (Medium) (GitHub Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-384 (Session Fixation) and CWE-613 (Insufficient Session Expiration). The login flow in auth_login.php (lines 203–207) directly assigns $_SESSION[SESS_USER_ID] without first calling session_regenerate_id(), meaning the pre-authentication session ID is preserved after login. The same flaw exists in the cookie-restore and basic-auth paths within include/auth.php. Although the session cookie configuration is otherwise hardened (httponly=true, samesite=Strict, secure=true for HTTPS as configured in include/global.php:513-537), these protections do not prevent session fixation via same-site vectors such as subdomain cookie injection or XSS. The fix, implemented in commit 2fa404e, adds proper session ID rotation in the affected authentication paths (GitHub Advisory, GitHub Commit).

A successful exploit allows an unauthenticated attacker to hijack an authenticated user's session, effectively impersonating that user within the Cacti application. This results in low confidentiality and integrity impact — the attacker can access monitoring data, configuration settings, and perform actions on behalf of the victim user, including potentially modifying device configurations or accessing sensitive network performance data. Availability is not directly impacted, but the ability to act as an authenticated user (including administrators) could enable further privilege escalation or destructive actions within the Cacti instance (GitHub Advisory).

1. Reconnaissance: Identify a target Cacti instance (version ≤ 1.2.30) accessible to both the attacker and the intended victim, using network scanning or OSINT.
2. Obtain a valid pre-auth session ID: The attacker visits the Cacti login page and records the PHPSESSID cookie value assigned by the server before authentication.
3. Inject the session cookie into the victim's browser: Using a same-site vector such as subdomain cookie injection (if the attacker controls a subdomain), an XSS vulnerability, or social engineering, the attacker sets the known PHPSESSID value in the victim's browser.
4. Wait for victim to authenticate: The victim navigates to the Cacti login page and logs in normally. Because session_regenerate_id() is never called, the server retains the same session ID and associates it with the now-authenticated session.
5. Hijack the session: The attacker uses the pre-set PHPSESSID value in their own browser to send requests to the Cacti instance, gaining full access to the victim's authenticated session and all associated privileges (GitHub Advisory).

• Network: Requests to the Cacti login page (auth_login.php) from one IP address followed shortly by authenticated requests using the same PHPSESSID from a different IP address.
• Logs: Web server access logs showing the same session cookie value used from two distinct source IP addresses — one pre-authentication and one post-authentication; authentication success events in Cacti logs (user_log table) where the session ID does not change between pre- and post-login requests.
• Application: Unexpected or anomalous user activity in Cacti audit logs (e.g., configuration changes, device additions) from accounts that do not match the user's normal behavior or working hours, potentially indicating session hijacking.

The primary remediation is to upgrade Cacti to version 1.2.31 or later, which adds proper session_regenerate_id() calls in auth_login.php and the cookie-restore/basic-auth paths in include/auth.php (GitHub Release, GitHub Commit). No official configuration-based workaround is provided for unpatched versions. As supplementary measures, administrators should restrict Cacti access to trusted networks, ensure HTTPS is enforced (which limits some cookie injection vectors), and consider deploying a web application firewall with rules to detect session fixation patterns.