Cacti vulnerabilities

CVEs per yearBy the year they were published

1. 20221
2. 202324
3. 202416
4. 20258
5. 202619

Known exploitedNewest addition to KEV first

• CVE-2022-46169

  Unauthenticated Command Injection

  Cacti · cacti

  ExploitedCritical9.8

Newest CVEs

• CVE-2026-49442

  Cacti: User Enumeration via Error Messages

  Cacti · cacti

  Medium5.3
• CVE-2026-39902

  Cacti: Authenticated RCE on Data Input

  Cacti · cacti

  High7.2
• CVE-2026-46531

  Cacti: Authenticated Stored 2nd-Order SQL Injection in automation_tree_rule_items.field (incomplete-fix variant of CVE-2024-31460 / CVE-2025-24368)

  Cacti · cacti

  Medium5.5
• CVE-2026-71287

  Cacti sanitize_sql_column() Regex Allowlist Permits SQL Time-Delay Functions Leading to Blind SQL Injection

  Cacti · cacti

  High8.8
• CVE-2026-40941

  Cacti: Package Import Signature Validation Bypass Allows Self-Signed Packages

  Cacti · cacti

  High7.1
• CVE-2026-40084

  Cacti: Arbitrary File Read via Path Traversal in Report `format_file` Parameter

  Cacti · cacti

  Medium6.5
• CVE-2026-40083

  Cacti: SQL Injection in managers.php

  Cacti · cacti

  High7.2
• CVE-2026-40082

  Cacti: Session Fixation via missing session_regenerate_id() after login

  Cacti · cacti

  Medium5.4
• CVE-2026-40080

  Cacti: Open Redirect via HTTP_REFERER substring check in auth_login_redirect

  Cacti · cacti

  Medium6.1
• CVE-2026-40079

  Cacti: Command Injection via escape_command() no-op in RRDtool execution

  Cacti · cacti

  High8.6