By vendor

Cacti vulnerabilities

Known CVEs affecting Cacti products, prioritized by severity, with SEC.co remediation and detection guidance.

5 published vulnerabilities

• CVE-2026-39951HIGH 7.6

  Cacti, a widely-used open-source tool for monitoring system performance and managing infrastructure faults, contains a stored SQL injection flaw in its Reports feature. An authenticated attacker can inject malicious SQL code through the graph_name_regexp parameter, which gets stored in the database and executed when accessed later. The vulnerability affects Cacti version 1.2.30 and earlier; it has been patched in version 1.2.31. The threat requires an existing user account to exploit, but once compromised, the attacker can read sensitive data, modify records, or degrade system availability.

• CVE-2026-39897MEDIUM 6.1

  Cacti, an open-source monitoring and performance management platform, contains a reflected cross-site scripting (XSS) vulnerability in its authentication footer component. An attacker can craft a malicious link that, when clicked by a user, injects arbitrary JavaScript into the victim's browser session. This could allow theft of session cookies, credential harvesting, or redirection to phishing sites. The vulnerability affects Cacti versions 1.2.30 and earlier; version 1.2.31 and later contain the fix.

• CVE-2026-39900MEDIUM 6.1

  Cacti, a widely-used open source tool for monitoring network performance and managing faults, has a reflected cross-site scripting (XSS) vulnerability in its auth_profile.php file. An attacker can craft a malicious link containing JavaScript code in the 'tab' parameter that executes in a victim's browser when they click it. The victim must be tricked into clicking the link, but once they do, the attacker gains the ability to steal session tokens, alter page content, or perform actions on behalf of the logged-in user. Cacti versions 1.2.30 and earlier are vulnerable; version 1.2.31 fixes the issue.

• CVE-2026-39899MEDIUM 5.3

  Cacti, a widely-used open source monitoring framework, contains a path traversal vulnerability in its package import functionality. An attacker can exploit a filename parameter in package_import.php to access files outside the intended directory, potentially reading sensitive configuration files or other protected data. The vulnerability requires no authentication and can be triggered remotely, but the confidentiality impact is limited. Cacti versions 1.2.30 and earlier are affected; upgrading to 1.2.31 or later resolves the issue.

• CVE-2026-39894LOW 2.9

  Cacti, an open-source performance monitoring framework, has a data integrity flaw in versions 1.2.30 and earlier. The issue stems from how the system handles decimal numbers when the server is configured with certain locales (like German) that use commas instead of periods as decimal separators. When Cacti sends metric data to RRDtool for storage, locale-dependent formatting causes the decimal separator to change from a period to a comma, which RRDtool doesn't recognize. This causes monitoring data to be misaligned or discarded entirely. The flaw requires specific server locale misconfiguration and is not remotely exploitable, but it silently corrupts your metrics—potentially masking real performance issues. The fix is available in version 1.2.31.