CVE-2026-40083: 
Cacti vulnerability analysis and mitigation

CVE-2026-40083 is a SQL Injection vulnerability in Cacti's managers.php file, arising from unsanitized deserialization combined with direct SQL string construction. It affects Cacti versions 1.2.30 and earlier (all versions prior to 1.2.31). The vulnerability was published on June 25, 2026, with the GitHub Security Advisory (GHSA-j9jv-6xjq-9hhj) published June 19, 2026. It carries a CVSS v3.1 base score of 7.2 (High) (GitHub Advisory, Red Hat Bugzilla).

The root cause (CWE-89) lies in managers.php at lines 756–766, where user-supplied input from the selected_graphs_array POST parameter is deserialized via cacti_unserialize() — which calls PHP's unserialize() with allowed_classes=false. While this prevents PHP object injection, it still permits arbitrary string arrays to be deserialized. The resulting array values are then directly imploded into a SQL DELETE statement (DELETE FROM snmpagent_managers WHERE id IN (...)) without any integer casting or parameterized query, enabling SQL injection. Exploitation requires an authenticated session with SNMP agent management permissions, and a concrete PoC payload is publicly documented in the advisory (GitHub Advisory). The fix applies array_map('intval', $selected_items) before the implode() call (GitHub Advisory).

Successful exploitation allows an authenticated attacker with SNMP agent management permissions to execute arbitrary SQL commands against the Cacti database, resulting in high confidentiality, integrity, and availability impact. An attacker can read sensitive configuration data and credentials stored in the database, modify or delete records, and — depending on database server configuration and privileges — potentially escalate to operating system command execution (e.g., via INTO OUTFILE or UDF abuse). This could facilitate lateral movement within the monitored infrastructure given Cacti's role as a network performance and fault management platform (GitHub Advisory, Red Hat Bugzilla).

1. Reconnaissance: Identify Cacti instances running version 1.2.30 or earlier using network scanning tools (e.g., Shodan, Censys) or by checking the Cacti version string on the login page.
2. Authentication: Log in to the Cacti web interface with credentials that have SNMP agent management permissions (e.g., an administrator or a user with delegated SNMP manager rights).
3. Navigate to SNMP Agent Management: Access the SNMP agent managers page at /cacti/managers.php.
4. Craft malicious POST request: Send a POST request to /cacti/managers.php with the following parameters, embedding a SQL injection payload in the serialized selected_graphs_array value:

   POST /cacti/managers.php
   action=actions&drp_action=1&selected_graphs_array=a:1:{i:0;s:25:"1) OR 1=1; DROP TABLE x--";}

5. SQL injection execution: The server deserializes the array, implodes the injected string directly into the SQL DELETE statement without integer validation, causing the injected SQL to execute against the database.
6. Achieve objective: Depending on database permissions, extract sensitive data (credentials, device configurations), manipulate records, or attempt OS-level command execution via database features (GitHub Advisory).

• Network: Unusual or repeated POST requests to /cacti/managers.php with action=actions and a selected_graphs_array parameter containing serialized PHP data with non-integer values or SQL keywords (e.g., OR, DROP, SELECT, UNION, --).
• Logs: Web server access logs showing POST requests to managers.php with abnormally long or encoded selected_graphs_array values; database error logs indicating SQL syntax errors or unexpected query patterns in snmpagent_managers table operations.
• Database: Unexpected deletions or modifications in the snmpagent_managers table; presence of new database users, tables, or stored procedures not created by Cacti administrators; evidence of INTO OUTFILE or UDF-related queries in database query logs.
• File System: Unexpected PHP or web shell files written to the Cacti web root (if database FILE privilege is enabled and exploited for file write).
• Process: Unusual child processes spawned by the web server or database process (e.g., bash, curl, wget) that may indicate OS command execution via database escalation (GitHub Advisory).

Upgrade Cacti to version 1.2.31 or later, which applies array_map('intval', $selected_items) before all implode() calls in managers.php, ensuring only integer values are used in SQL construction (GitHub Release, GitHub Advisory). As interim mitigations, restrict SNMP agent management permissions to the minimum set of trusted administrators, and implement network-level access controls (firewall rules, VPN) to limit who can reach the Cacti management interface. Organizations should also audit other form_actions() implementations in their Cacti deployment for similar unsanitized deserialization-to-SQL patterns.

The vulnerability was responsibly disclosed by researchers Texuguinho1234 and jpgjpgjpgjpg, coordinated by Cacti maintainer netniV (GitHub Advisory). The Cacti 1.2.31 release notes acknowledge the security community's role in responsible disclosure and note that this release addresses a large number of vulnerabilities reported by external researchers (GitHub Release). Red Hat has tracked the issue via Bugzilla and assigned it high severity (Red Hat Bugzilla). No significant broader media coverage or notable social media discussion has been identified at this time.