CVE-2026-49442: 
Cacti vulnerability analysis and mitigation

CVE-2026-49442 is a user enumeration vulnerability in Cacti, an open source performance and fault management framework, that allows unauthenticated attackers to identify valid usernames via subtly different login error messages. All versions prior to 1.2.31 (i.e., <= 1.2.30) are affected. The vulnerability was reported by researcher nurannuri800, coordinated by netniV, and the advisory (GHSA-m7v2-f3xw-3qh7) was published on June 19, 2026, with the fix merged on May 26, 2026. It carries a CVSS v3.1 base score of 5.3 (Medium) (GitHub Advisory).

The root cause is classified as CWE-204 (Observable Response Discrepancy): the Cacti login handler in lib/auth.php returned two distinct error messages depending on whether the submitted username existed in the database. For a valid username, the response read Access Denied! Login failed. (lowercase 'f'), while for an invalid username it read Access Denied! Login Failed. (uppercase 'F') — a single-character capitalization difference that leaks internal state to unauthenticated network clients. No authentication, special privileges, or user interaction are required to exploit this behavior; an attacker only needs network access to the Cacti login page. The fix, applied in commit ab4baf3, standardizes both code paths to return the same message (Access Denied! Login Failed.), eliminating the discrepancy (GitHub Advisory, Fix Commit).

Successful exploitation allows an unauthenticated attacker to enumerate valid usernames on a Cacti instance, which has a low confidentiality impact and no direct integrity or availability impact. The primary risk is that a confirmed list of valid usernames significantly lowers the barrier for follow-on attacks such as targeted password brute-force, credential stuffing, or social engineering campaigns against Cacti administrators and monitored infrastructure operators (GitHub Advisory).

No public proof-of-concept exploit code or weaponized tooling has been identified for this vulnerability. There is no evidence of in-the-wild exploitation, no threat actor attribution, and the CVE is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS score is 0.0, reflecting a very low probability of exploitation in the near term (GitHub Advisory).

1. Reconnaissance: Identify internet-facing Cacti instances (versions <= 1.2.30) using search engines like Shodan or Censys, or by directly browsing to the Cacti login page.
2. Prepare username list: Compile a wordlist of candidate usernames (e.g., admin, cacti, monitor, common first/last name combinations).
3. Submit login requests: For each candidate username, send an HTTP POST request to the Cacti login endpoint with the candidate username and an arbitrary password.
4. Analyze response messages: Compare the error message in each response:
   • Access Denied! Login failed. (lowercase 'f') → username exists in the system.
   • Access Denied! Login Failed. (uppercase 'F') → username does not exist.
5. Build valid username list: Record all usernames that returned the lowercase-'f' variant as confirmed valid accounts.
6. Launch follow-on attacks: Use the confirmed usernames for targeted brute-force, credential stuffing, or phishing campaigns against Cacti administrators (GitHub Advisory).

• Network: High volume of HTTP POST requests to the Cacti login endpoint (e.g., /cacti/index.php) from a single IP or small IP range, each with a different username but the same or no valid password.
• Logs: Web server access logs showing repeated failed login attempts with varied usernames in rapid succession; application logs recording multiple Access Denied events from the same source IP.
• Behavioral: Systematic username enumeration pattern — sequential or dictionary-based username submissions with consistent timing intervals suggesting automated tooling rather than human login attempts.

Upgrade Cacti to version 1.2.31 or later, which standardizes the login error message regardless of whether the username exists, eliminating the observable discrepancy (GitHub Advisory, Fix PR). As a short-term workaround for organizations unable to upgrade immediately, deploying a web application firewall (WAF) rule to rate-limit or block repeated failed login attempts from the same source IP can reduce the effectiveness of automated enumeration. Additionally, placing the Cacti login page behind network access controls (VPN, IP allowlisting) limits exposure to trusted networks only.