CVE-2026-40083

Name of the Vulnerable Software and Affected Versions Cacti versions prior to 1.2.31

Description An issue exists in the performance and fault management framework where improper handling of deserialized data leads to SQL Injection. In the 'managers.php' file, the application processes the selected graphs array variable using a custom unserialize function. While object injection is prevented, arbitrary string arrays can still be deserialized. These values are subsequently passed to the db execute() function and merged into a SQL DELETE statement via an implode operation without integer validation. This allows for SQL Injection when utilizing SNMP agent management permissions.

Recommendations Update to version 1.2.31.