What is the CVSS score of CVE-2026-39894?

CVE-2026-39894 has a CVSS 3.1 base score of 2.5 (Low). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.1%.

Cacti CVE-2026-39894

LOW

Use of Function with Inconsistent Implementations (CWE-474)

N/A vendor:alpine

Information Disclosure Cacti

2.5

CVSS 3.1 · NVD

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Unknown attacker position
Exploit

Unknown vulnerability trigger in Cacti
Impact

Unknown impact

Vulnerability Assessment

Weakness	CWE CWE-474 ASVS 5.0 V15 - Secure Coding and Architecture Use of function with inconsistent implementations
Exploitation Conditions	Exploitation conditions cannot be determined from the available data. No description of the vulnerability, no CVSS vector, and no CWE are present to identify required configuration, authentication level, network position, user interaction, or specific feature enablement. Defenders cannot assess realistic risk until upstream advisory details are published. FORBIDDEN inference has been avoided - no conditions are assumed or stated as confirmed.
Impact	Risk cannot be meaningfully assessed from the available data. No CVSS vector, CVSS score, CWE, EPSS score, KEV status, POC availability, or vulnerability description is present beyond the fix version in Alpine Linux. The absence of KEV listing and POC reports is a mild positive signal, but this does not confirm low severity - it may simply reflect delayed disclosure or a vendor-only report stage. SSVC exploitation status is unknown. Defenders should treat this as uncharacterized risk until the upstream Cacti advisory or NVD enrichment is published. CRITICAL DATA GAP: The vulnerability type, attack vector, authentication requirements, and scope of impact are entirely unknown from the provided intelligence.
Exploit ScenarioDerived	No exploit scenario can be responsibly constructed from the available data. The vulnerability type, affected component, and required attacker position are entirely uncharacterized. No POC code has been identified at time of analysis.

Monitor Track and reassess. Why: LOW severity (CVSS 0.1-3.9).

No patch listed yet 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jun 18, 2026

Cacti, the open-source network monitoring and graphing solution, contains an unspecified vulnerability addressed in Alpine Linux package version 1.2.31-0. The vulnerability type, affected component, and attacker-accessible impact are not disclosed in the available intelligence. No public exploit has been identified at time of analysis, and CISA KEV listing is absent, leaving severity and exploitation conditions uncharacterized from the data provided.

RemediationAI

Upgrade the Alpine Linux cacti package to version 1.2.31-0 or later using the Alpine package manager: apk upgrade cacti. Vendor-released patch: cacti 1.2.31-0 (Alpine Linux package). No upstream Cacti advisory URL was provided in the available data, so administrators should also consult the official Cacti project release notes and security advisories for the corresponding upstream fix. If immediate patching is not feasible, consider restricting network access to the Cacti web interface to trusted management networks as a compensating control, noting this does not address authenticated or internal-origin attack paths if those apply.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

Cacti is a PHP-based network graphing and fault management framework built atop RRDTool, commonly deployed for SNMP-based infrastructure monitoring. The fix is documented as an Alpine Linux package update to cacti 1.2.31-0, suggesting an upstream Cacti release at or above 1.2.31 addresses the issue. No CWE is provided, so the root cause class - historically spanning SQL injection, command injection, XSS, and authentication bypass in Cacti - cannot be determined from available data. No CPE strings were supplied to narrow affected platform or architecture scope.

Know when Cacti gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 2.5 LOW

AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

CVSS changed

Jun 25, 2026 - 20:22 NVD

2.9 (LOW) 2.5 (LOW)

CVSS changed

Jun 24, 2026 - 22:22 NVD

2.9 (LOW)

DescriptionNVD

Alpine Linux: cacti fixed in 1.2.31-0

Threat Intelligence Overview

EPSS Score

0.1%

Top 98% exploitable

Data Quality

4 sources

Confidence: Medium

NVD

CVE.org

EPSS

GitHub

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity LOW

CISA KEV No

Public POC No

EPSS 0.1%

Patch available No

Active threat No

Deciding rule

LOW severity (CVSS 0.1-3.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Defer

Exploitation· derived

None

System Exposure· derived

Small

Automatable· derived

Human Impact· derived

Low

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +12

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.