CVE-2026-40083
Received Received - Intake
SQL Injection in Cacti Performance Monitoring Framework

Publication date: 2026-06-25

Last updated on: 2026-06-25

Assigner: GitHub, Inc.

Description
Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior have SQL Injection through unsanitized unserialize+implode in managers.php. At line 756 of managers.php, the application assigns $selected_items by calling cacti_unserialize(stripslashes(gnrv('selected_graphs_array'))). The cacti_unserialize() function calls unserialize() with allowed_classes set to false, which prevents object injection but still allows arbitrary string arrays to be deserialized. Then, at lines 760 to 766, the deserialized array values are passed directly into db_execute('DELETE FROM snmpagent_managers WHERE id IN (' . implode(',', $selected_items) . ')'), where they are imploded into the SQL statement without any integer validation, resulting in SQL Injection when using SNMP agent management permissions. This issue has been fixed in version 1.2.31.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-06-25
Last Modified
2026-06-25
Generated
2026-06-26
AI Q&A
2026-06-26
EPSS Evaluated
N/A
NVD
CVE-2026-40083
Affected Vendors & Products
Showing 2 associated CPEs
Vendor Product Version / Range
cacti cacti to 1.2.31 (exc)
cacti cacti 1.2.31
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability exists in Cacti versions 1.2.30 and prior, where an SQL Injection flaw occurs in the managers.php file. The issue arises because the application unserializes user input without proper validation and then directly uses the resulting array values in an SQL DELETE statement without ensuring they are integers. Specifically, the deserialized array values are concatenated into the SQL query via implode without integer validation, allowing an attacker with SNMP agent management permissions to inject malicious SQL code.

Impact Analysis

This SQL Injection vulnerability can have severe impacts including unauthorized data manipulation or deletion, data leakage, and potentially full compromise of the database. Because the vulnerability allows an attacker to execute arbitrary SQL commands with SNMP agent management permissions, it can lead to loss of data integrity, confidentiality, and availability.

Mitigation Strategies

The vulnerability is fixed in Cacti version 1.2.31. The immediate step to mitigate this vulnerability is to upgrade your Cacti installation to version 1.2.31 or later.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-40083. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart