CVE-2026-40083: Cacti SQL Injection in SNMP Manager Feature (v1.2.30 and Prior)

Technical summary

The vulnerability exists in managers.php at lines 756–766. The application deserializes user-supplied input via cacti_unserialize(stripslashes(gnrv('selected_graphs_array'))), which calls PHP's unserialize() with allowed_classes=false to block object injection. However, this configuration still permits deserialization of arbitrary array structures. The resulting array is then directly imploded and injected into a DELETE statement: db_execute('DELETE FROM snmpagent_managers WHERE id IN (' . implode(',', $selected_items) . ')'). Because the array values undergo no integer type validation before concatenation, an attacker can supply malicious string payloads that escape the IN clause and inject additional SQL. Exploitation requires valid SNMP agent management permissions, limiting the attack surface to authenticated users with elevated privileges.

Business impact

This vulnerability allows a privileged insider or compromised admin account to exfiltrate sensitive data from the Cacti database, modify or delete monitoring records, or potentially escalate privileges depending on database user permissions. For organizations relying on Cacti for critical infrastructure monitoring (networks, servers, applications), database tampering could degrade visibility into system health and performance, obscure security events, or corrupt operational data. The high CVSS score (7.2) reflects the combination of high impact (confidentiality, integrity, availability all affected) and the authenticated but elevated-privilege attack vector.

Affected systems

Cacti versions 1.2.30 and all prior releases are vulnerable. The flaw is triggered only when an attacker possesses SNMP agent management permissions, so systems where that role is not assigned to any users face reduced risk. Organizations should audit who holds SNMP management roles and whether untrusted or former staff retain such access. Self-hosted and on-premises Cacti deployments are the primary concern; SaaS deployments depend on the provider's patching practices.

Exploitability

Exploitation requires valid authentication and SNMP agent management role assignment, which moderates the attack surface. No public exploit code has been reported, and the vulnerability is not tracked in CISA's Known Exploited Vulnerabilities catalog. However, the SQL injection mechanism is straightforward to weaponize once an attacker understands the serialization format and payload structure. The attack does not require user interaction and can be automated. Organizations should treat this as a moderately urgent but not imminent threat, with priority based on the number of high-privilege Cacti users and the sensitivity of data in the underlying database.

Remediation

Upgrade to Cacti version 1.2.31 or later. Before patching, restrict SNMP agent management permissions to only essential personnel and audit current role assignments. Ensure database user accounts running Cacti queries operate under the principle of least privilege (read/write only to required tables, not to system tables). Consider network segmentation to limit access to Cacti interfaces from trusted networks only. If immediate patching is not feasible, disable SNMP agent management features temporarily or restrict access to those pages via application-level controls.

Patch guidance

Verify the current Cacti version by checking /include/cacti/version.php or running the upgrade check in the Cacti web interface. Download version 1.2.31 or the latest stable release from the official Cacti website or repository. Test the upgrade in a non-production environment first, particularly if custom plugins or integrations are in use. Follow the official Cacti upgrade documentation and back up the database before applying patches. After upgrade, verify SNMP manager functionality works as expected and confirm the patched managers.php is in place.

Detection guidance

Monitor Cacti access logs for unusual requests to managers.php containing suspicious query parameters, especially those with uncommon characters or URL-encoded SQL syntax (e.g., %27, %20OR, UNION). Database query logs should be reviewed for unexpected DELETE statements against snmpagent_managers or similar tables. Web application firewalls (WAF) can be tuned to block requests with serialized array payloads or SQL injection patterns directed at manager-related endpoints. Additionally, monitor for database errors or warnings logged by the Cacti application that may indicate failed or malformed SQL execution.

Why prioritize this

This vulnerability merits prompt attention due to its HIGH severity rating, direct impact on data integrity and confidentiality, and the administrative context in which it operates. Although it requires authenticated access with elevated privileges, insider threats and compromised admin credentials are realistic scenarios. Cacti's role in infrastructure visibility makes database tampering particularly damaging. The existence of a tested patch (version 1.2.31) and the absence of known public exploits create a window to patch proactively before mass exploitation occurs.

Risk score, explained

The CVSS 3.1 score of 7.2 (HIGH) reflects: Attack Vector=Network (remotely exploitable), Attack Complexity=Low (no special conditions needed), Privileges Required=High (attacker must have SNMP manager role), User Interaction=None, Scope=Unchanged, and maximum impact on Confidentiality, Integrity, and Availability. The authentication requirement prevents an unauthenticated attacker from exploiting this, which moderates the overall score. However, the broad impact across all three CIA pillars and the straightforward nature of SQL injection keep the severity in the HIGH band.

Frequently asked questions