CVE-2026-46531 Cacti CVE debrief

Who should care

Defenders responsible for Cacti instances, particularly those with Automation realm user accounts, should assess exposure and prioritize patching to prevent potential data exfiltration. They should also verify Automation realm user accounts, monitor for suspicious automation rule activities, and consider the limited information available on potential exploitation or impact.

Why it matters

This vulnerability allows authenticated users to inject SQL fragments, potentially leading to data exfiltration and privilege escalation. Defenders should prioritize patching and verify Automation realm user accounts.

• Potential data exfiltration through injected SQL
• Execution of arbitrary SQL fragments
• Elevation of privileges for Automation realm users
• Required verification of Automation realm user accounts

Technical summary

Cacti versions 1.2.27 to before 1.2.31 contain an authenticated stored second-order SQL injection vulnerability in the automation tree rule item handler. A user with Automation realm privileges can inject SQL fragments, which are executed when an administrator triggers automation, potentially leading to data exfiltration. The vulnerability allows authenticated users to persist an arbitrary SQL fragment in the automation_tree_rule_items.field column. The fragment is later concatenated directly into a SELECT ... AS source FROM ... clause and executed when an administrator triggers automation via the standard graphs.php?action=actions&drp_action=8 bulk action.

Defensive priority

Defenders should prioritize patching Cacti instances, verifying Automation realm user accounts, and monitoring for suspicious automation rule activities.

Recommended defensive actions

• Patch Cacti instances to version 1.2.31 or later
• Verify Automation realm user accounts and privileges
• Monitor for suspicious automation rule activities
• Restrict access to automation features
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and source item provide details on the vulnerability, affected versions, and patch information. Additional information on potential exploitation or impact is limited. However, defenders should verify Automation realm user accounts, monitor for suspicious automation rule activities, and consider the limited information available on potential exploitation or impact.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.