CVE-2026-39951: Cacti Stored SQL Injection in Reports Feature (v1.2.30 and Prior)

Technical summary

CVE-2026-39951 is a CWE-89 SQL injection vulnerability affecting Cacti's Reports feature. The flaw exists in improper sanitization of the graph_name_regexp parameter, allowing authenticated users to craft payloads that are stored and later executed in SQL queries. Unlike reflected injection, stored variants persist in the database and fire automatically when the affected data is retrieved, multiplying exposure across all users and increasing the severity. The vulnerability scores 7.6 (HIGH) under CVSS 3.1 with a vector of CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L—indicating network accessibility, low complexity, authenticated access requirement, and high confidentiality impact alongside some integrity and availability degradation.

Business impact

A compromised Cacti instance can leak performance metrics, user data, and infrastructure intelligence valuable to attackers planning lateral moves or targeted attacks. Report data modified via SQL injection could mask monitoring anomalies, delaying incident detection. For organizations relying on Cacti for SLA tracking or compliance reporting, injected data could invalidate audit trails and create regulatory exposure. Depending on database permissions and deployment, attackers might escalate beyond Cacti to the underlying database server.

Affected systems

Cacti version 1.2.30 and all prior releases are vulnerable. Version 1.2.31 and later contain the fix. Deployment scope varies widely—Cacti is popular in enterprises for SNMP-based infrastructure monitoring, as well as in smaller operations. Organizations should inventory all Cacti instances and verify their version against 1.2.31.

Exploitability

Exploitation requires prior authentication, reducing the immediate risk from anonymous attackers. However, many Cacti deployments use default or weak credentials, or run in trust-based networks where internal access is assumed safe. The attack surface is the Reports feature, accessible to any authenticated user. No unusual user interaction is required once the payload is injected—it executes server-side when the report is fetched. CVSS reflects this as 'PR:L' (low privilege required) and 'UI:N' (no user interaction needed). The vulnerability is not currently tracked on the CISA Known Exploited Vulnerabilities list.

Remediation

Upgrade Cacti to version 1.2.31 or later. This is the definitive fix. In the interim, restrict access to the Reports feature via firewall or application-level controls, and audit user accounts to revoke unnecessary report-creation privileges. Review recent report creation logs for suspicious graph_name_regexp values (look for SQL keywords, comment markers, or unusual syntax). If SQL injection is suspected, inspect the underlying database for unauthorized tables, data exfiltration, or schema changes.

Patch guidance

Download Cacti 1.2.31 from the official repository and follow the vendor's upgrade documentation. Test the patch in a staging environment first to ensure compatibility with your plugins, custom graphs, and monitoring workflows. During patching, Cacti monitoring will be briefly offline; schedule this during a maintenance window. Verify the upgrade by checking the version string in the Cacti console and confirming report functionality. After patching, review user permissions and disable unused report-generation accounts.

Detection guidance

Monitor Cacti application and database logs for SQL syntax errors, unusual query patterns, or slow queries triggered by report generation. Check for report names or graph filters containing SQL keywords (SELECT, UNION, DROP, EXEC, etc.) or comment sequences (--,/*,*/). Query the Cacti database directly for anomalous stored procedures or functions created after the last known maintenance window. Correlate Cacti activity with database access logs to identify reads or writes from unexpected sources. SIEM rules should flag report API calls followed by database errors or long query execution times.

Why prioritize this

Although exploitation requires authentication, the high CVSS score (7.6) reflects the serious confidentiality and integrity impact. Cacti is often deployed in sensitive network monitoring roles where data breaches and tampering carry significant operational and compliance consequences. The simplicity of the attack vector (network-accessible, low complexity) and the lack of active exploitation data should not lull teams into complacency—upgrading is straightforward and should be prioritized within two weeks, sooner if Cacti runs in high-trust or customer-facing environments.

Risk score, explained

A CVSS 3.1 score of 7.6 (HIGH) reflects the combination of network accessibility, straightforward exploitation technique, and severe impacts on data confidentiality (reading arbitrary database contents) and some degradation of integrity and availability. The requirement for prior authentication ('PR:L') prevents the score from reaching CRITICAL, but the absence of user interaction and the potential to affect all report consumers elevates the threat. Organizations with strong access controls and network segmentation may experience lower real-world risk; those with permissive internal networks face proportionally higher risk.

Frequently asked questions