CVE-2026-71287 Cacti CVE debrief

Who should care

Cacti administrators, security teams, and users with access to Cacti installations should be aware of this vulnerability and take steps to mitigate it. Affected parties should review and update Cacti installations to ensure the latest security patches are applied, restrict access to sensitive Cacti functionality for low-privilege users, and monitor Cacti logs for suspicious SQL injection activity. Additionally, implementing additional security controls to detect and prevent SQL injection attacks is recommended. IT operations teams and cybersecurity response teams may need to coordinate on response efforts and verify patch deployment. Cacti users should also consider compensating controls for exposed systems while remediation is scheduled and verified. Security teams should track exceptions, retest remediated assets, and close the item only after evidence is documented. This may involve coordination with Cacti support teams or third-party security consultants for thorough validation and verification of mitigations. The potential operational impact of this vulnerability is significant, as successful exploitation could lead to unauthorized access or manipulation of sensitive data within the Cacti database. Therefore, prompt attention and thorough remediation are crucial to minimize risk exposure. Security teams should also review relevant monitoring, detection, and logs for exposed assets that need extra review, and consider asset inventory management to ensure all Cacti instances are accounted for and properly secured. Overall, a coordinated and comprehensive response is necessary to address this vulnerability effectively and protect against potential threats. Cacti users must prioritize this vulnerability for immediate review and mitigation due to its high severity and potential for significant impact. The involvement of multiple stakeholders, including IT operations, cybersecurity teams, and possibly external security experts, will be essential in ensuring a thorough and effective response to this security issue. By taking proactive and coordinated measures, Cacti users can mitigate the risks associated with this vulnerability and protect their installations and

Technical summary

The Cacti sanitize_sql_column() function in lib/functions.php does not properly sanitize user-supplied ORDER BY column names, allowing an authenticated user to perform time-based blind SQL injection attacks. The vulnerability is caused by a flawed regex pattern that allows certain characters to pass through unmodified, which can then be concatenated into raw SQL ORDER BY clauses. This issue affects Cacti installations and can be exploited by authenticated users with low privileges.

Defensive priority

Authenticated users with low privileges can exploit this vulnerability to perform time-based blind SQL injection attacks against the Cacti database, potentially leading to high impact.

Recommended defensive actions

• Review and update Cacti installations to ensure the latest security patches are applied
• Restrict access to sensitive Cacti functionality for low-privilege users
• Monitor Cacti logs for suspicious SQL injection activity
• Implement additional security controls to detect and prevent SQL injection attacks
• Perform vulnerability scanning to identify exposed Cacti instances
• Verify patch deployment and conduct thorough validation and verification of mitigations
• Track and document remediation efforts for auditing and compliance purposes

Evidence notes

The CVE-2026-71287 record indicates that Cacti's sanitize_sql_column() function in lib/functions.php does not properly sanitize user-supplied ORDER BY column names, allowing an authenticated user to perform time-based blind SQL injection attacks. The vulnerability has a CVSS score of 8.8 and is considered HIGH severity. Evidence is limited to public CVE and NVD information. Defenders should verify Cacti installations, review logs for suspicious activity, and ensure the latest security patches are applied.

Official resources