Cacti has 4 CVEs on record between 2025 and 2026. 3 were published in the last 90 days. The busiest recent month was October 2026 with 3. The median CVSS is 6.3 (medium).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 6.3
- Publish → KEV
- —
- Last 90 days
- 3 prev 0
Worst active — by depth score
CVE-2005-10004High· 8.8Cacti versions prior to 0.8.6-d contain a remote command execution vulnerability in the graph_view.php script61CVE-2026-39902High· 7.2Cacti: Authenticated RCE on Data Input52CVE-2026-46531Medium· 5.5Cacti: Authenticated Stored 2nd-Order SQL Injection in automation_tree_rule_items.field (incomplete-fix variant of CVE-2024-31460 / CVE-2025-24368)30CVE-2026-49442Medium· 5.3Cacti: User Enumeration via Error Messages29
Cacti vulnerabilities
CVEs affecting Cacti, newest first. Open any entry for full detail, references, and exploit status.
4 CVEsRSS
CVE-2026-46531Medium· 5.5Cacti: Authenticated Stored 2nd-Order SQL Injection in automation_tree_rule_items.field (incomplete-fix variant of CVE-2024-31460 / CVE-2025-24368)
Cacti is an open source performance and fault management framework. From version 1.2.27 to before version 1.2.31, Cacti contains an authenticated stored second-order SQL injection in the automation tree rule item handler. A user holding …
CVE-2026-39902High· 7.2PoCCacti: Authenticated RCE on Data Input
Cacti is an open source performance and fault management framework. Prior to version 1.2.31, the prior blocklist ([;&| `$\\n\r]) omitted single-quote, double-quote, redirect operators, subshell parens and braces. An authenticated admin c…
CVE-2026-49442Medium· 5.3Cacti: User Enumeration via Error Messages
Cacti is an open source performance and fault management framework. Prior to version 1.2.31, a User Enumeration vulnerability allows an attacker to identify valid usernames on the Cacti service. When a user attempts to log in, the applic…
CVE-2005-10004High· 8.8PoCCacti versions prior to 0.8.6-d contain a remote command execution vulnerability in the graph_view.php script
Cacti versions prior to 0.8.6-d contain a remote command execution vulnerability in the graph_view.php script. An authenticated user can inject arbitrary shell commands via the graph_start GET parameter, which is improperly handled durin…