CVE-2026-71287: 
Cacti vulnerability analysis and mitigation

CVE-2026-71287 is a time-based blind SQL injection vulnerability in Cacti's sanitize_sql_column() function (lib/functions.php) that allows any authenticated user to inject arbitrary SQL into ORDER BY clauses. It affects Cacti versions up to and including 1.3.0-dev (the active development branch). The vulnerability was published on August 5, 2026, with the GitHub Advisory (GHSA-7v66-c77r-g454) published the same day. It carries a CVSS v3.1 base score of 8.8 (High) (Github Advisory).

The root cause is an insufficient input allowlist in sanitize_sql_column(), classified as CWE-89 (SQL Injection). The function applies preg_replace('/[^a-zA-Z0-9_().]/', '', $column) to user-supplied ORDER BY column names, intending to support expressions like COUNT(id) and table.column. However, this allowlist inadvertently permits SQL function calls such as SLEEP(5) to pass through unmodified, since they consist entirely of allowed characters. The sanitized value is then concatenated directly into raw SQL ORDER BY clauses — a context that cannot use parameterized queries — driven by the sort_column GET parameter in at least user_log.php, utilities.php, user_domains.php, and user_group_admin.php. The attack is network-accessible, requires only low-privilege authentication, and no user interaction (Github Advisory, Cacti functions.php).

Any authenticated Cacti user, regardless of privilege level, can perform time-based blind SQL injection against the Cacti database, enabling extraction of sensitive data (credentials, configuration, user information), modification of database records, and potentially operating system command execution if the database account has elevated permissions. The technical impact is rated as total across confidentiality, integrity, and availability. Because Cacti is commonly deployed as a network monitoring platform with access to device credentials and infrastructure data, successful exploitation could facilitate lateral movement into monitored network infrastructure (Github Advisory).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation as of the time of publication (Github Advisory). The EPSS score is approximately 0.25–0.31%, placing it in the 23rd percentile for exploitation likelihood within 30 days. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is not automatable (per NVD SSVC assessment) because it requires authenticated access, though the low privilege requirement means any registered Cacti user can attempt it. Detection coverage exists via Nessus (plugin 334475) and Qualys (plugin 532053) (Github Advisory).

1. Authenticate: Log in to the target Cacti instance with any valid user account, regardless of privilege level.
2. Identify vulnerable endpoints: Navigate to pages that accept a sort_column GET parameter, including user_log.php, utilities.php, user_domains.php, and user_group_admin.php.
3. Craft a time-based blind SQL injection payload: Construct a payload using only characters permitted by the allowlist (letters, digits, underscores, parentheses, dots). For example: SLEEP(5) or (CASE WHEN (1=1) THEN SLEEP(5) ELSE id END).
4. Inject via GET parameter: Send a request such as GET /user_log.php?sort_column=SLEEP(5)&sort_direction=ASC. Because the payload passes through sanitize_sql_column() unmodified, it is concatenated directly into the SQL ORDER BY clause.
5. Observe timing response: A delayed server response (e.g., ~5 seconds) confirms successful injection and that the condition evaluated to true.
6. Enumerate database contents: Use time-based boolean inference techniques (e.g., with tools like sqlmap using --technique=T) to extract database schema, user credentials, or other sensitive data from the Cacti database (Github Advisory).

• Network: HTTP GET requests to user_log.php, utilities.php, user_domains.php, or user_group_admin.php with sort_column parameter values containing SQL function calls (e.g., SLEEP, BENCHMARK, IF, CASE) or unusual expressions with parentheses.
• Logs: Web server access logs showing repeated requests to the above endpoints with sort_column values that differ from expected column names; responses with anomalously high latency (e.g., 5+ seconds) correlating with SLEEP()-style payloads.
• Database: Slow query logs in MySQL/MariaDB showing ORDER BY clauses containing SLEEP(), BENCHMARK(), or conditional expressions originating from Cacti's database user.
• Application: Cacti application logs showing unexpected SQL errors or warnings related to ORDER BY clause parsing.

Update Cacti to a patched version that implements proper column validation — either using a strict whitelist of expected column names rather than character filtering, or restructuring the query logic to avoid direct concatenation. As an interim workaround, restrict network access to the Cacti web interface to trusted users and IP ranges only, and apply the principle of least privilege to the database account used by Cacti to limit the impact of any successful injection. Monitor for a patched release from the Cacti project and apply it promptly (Github Advisory, Cacti Repository).

The vulnerability was reported by TuranSec and covered briefly by The Hacker Wire, which published a technical summary shortly after disclosure. The CISA Vulnerability Bulletin (SB26-222) referenced the CVE in its weekly summary. No major vendor statements or significant community debate have been observed beyond standard aggregator coverage.