CVE Watch18 de out. de 2026

CVE-2025-66399

Cacti is an open source performance and fault management framework. Prior to 1.2.29, there is an input-validation flaw in the SNMP device co

CVSS

8.8

Alta

EPSS

10.8%

p96

KEV

—

Exploit Today

0-100

Publicado: 2 de dez. de 2025 · Última mod.: 18 de out. de 2026 · CWE-77

EPSS · 30d

10.8%EPSS · 30 dias10.8%

2026-10-142026-11-11

Descrição técnica

Cacti is an open source performance and fault management framework. Prior to 1.2.29, there is an input-validation flaw in the SNMP device configuration functionality. An authenticated Cacti user can supply crafted SNMP community strings containing control characters (including newlines) that are accepted, stored verbatim in the database, and later embedded into backend SNMP operations. In environments where downstream SNMP tooling or wrappers interpret newline-separated tokens as command boundaries, this can lead to unintended command execution with the privileges of the Cacti process. This vulnerability is fixed in 1.2.29.

Referências oficiais

github.comhttps://github.com/Cacti/cacti/security/advisories/GHSA-c7rr-2h93-7gjf

CVEs relacionados

CVECVSSEPSSKEVRExploitTítuloMod.

CVE-2026-1261677.2 ALT

—

——0A improper neutralization of special elements used in a command ('command injection') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.2, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an authenticated remote attacker with domain admin or admin privileges to delete users of other tenant domains on a paired FortiAuthenticator, execute arbitrary code as root or arbitrary CLI commands, and read or write arbitrary files as root via crafted HTTP requests to the administrative interface.19h CVE-2026-960537.8 ALT

54.6%

——16Improper neutralization of special elements used in a command ('command injection') in Windows Task Scheduler allows an authorized attacker to elevate privileges locally.2d CVE-2026-839535.5 MÉD

57.9%

——17Improper neutralization of special elements used in a command ('command injection') in Github Copilot allows an authorized attacker to disclose information locally.2d CVE-2026-1233878.0 ALT

57.3%

——17Improper neutralization of special elements used in a command ('command injection') in Windows Active Directory allows an authorized attacker to elevate privileges over a network.2d CVE-2026-1216628.6 ALT

45.1%

——14Improper neutralization of special elements used in a command ('command injection') in Visual Studio Code allows an unauthorized attacker to execute code locally.2d CVE-2026-1199898.2 ALT

48.7%

——15Improper neutralization of special elements used in a command ('command injection') in Azure Pipelines allows an authorized attacker to execute code over a network.2d