PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-40083 Cacti CVE debrief

CVE-2026-40083 is a SQL injection vulnerability in Cacti, an open-source performance and fault management framework. The issue affects versions 1.2.30 and prior, where unsanitized unserialize and implode functions in managers.php allow for SQL injection. Specifically, the application deserializes user-input data without proper validation, leading to potential SQL injection when using SNMP agent management permissions. This vulnerability has been fixed in version 1.2.31. Users should upgrade to the latest version to mitigate this risk. Additionally, defenders should review their Cacti installations for any suspicious activity and ensure proper input validation is in place.

Vendor
Cacti
Product
Unknown
CVSS
HIGH 7.2
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-25
Original CVE updated
2026-06-30
Advisory published
2026-06-25
Advisory updated
2026-06-30

Who should care

System administrators and security teams responsible for Cacti installations should be aware of this vulnerability. Given the high CVSS score of 7.2, this issue should be prioritized for immediate attention, especially in environments where SNMP agent management permissions are utilized. Users of Cacti versions 1.2.30 and prior are at risk and should take action to upgrade or apply mitigations.

Technical summary

The vulnerability is caused by the use of unsanitized unserialize and implode functions in managers.php at lines 756 to 766. The cacti_unserialize() function deserializes user-input data without proper validation, allowing for arbitrary string arrays to be deserialized. These deserialized array values are then passed directly into a SQL statement without integer validation, resulting in SQL injection. The CVSS vector for this vulnerability is CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, indicating a high severity score.

Defensive priority

High priority should be given to upgrading Cacti to version 1.2.31 or later. In addition to upgrading, defenders should review Cacti logs for suspicious activity and ensure that input validation is properly implemented for SNMP agent management permissions.

Recommended defensive actions

  • Upgrade Cacti to version 1.2.31 or later
  • Review Cacti logs for suspicious activity related to SNMP agent management
  • Ensure proper input validation for SNMP agent management permissions
  • Monitor for any unusual database queries or errors
  • Consider implementing additional security measures such as web application firewalls

Evidence notes

The CVE-2026-40083 vulnerability was made public on June 25, 2026, and has since been modified on June 29, 2026. The vulnerability affects Cacti versions 1.2.30 and prior. The CVSS score for this vulnerability is 7.2, indicating a high severity. The source item URL provides additional details about the vulnerability, including references to mitigation and vendor advisories.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-40083 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-40083

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-40083 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-40083

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.