Read the docs
TI-2023-26751 Aliases CVE-2023-49086

Cacti is vulnerable to cross-Site scripting (XSS) DOM

Priority LOW 27CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

Cacti is a robust performance and fault management framework and a frontend to RRDTool - a Time Series Database (TSDB). A vulnerability in versions prior to 1.2.27 bypasses an earlier fix for CVE-2023-39360, therefore leading to a DOM XSS attack. Exploitation of the vulnerability is possible for an authorized user. The vulnerable component is the `graphs_new.php`. The impact of the vulnerability is execution of arbitrary JavaScript code in the attacked user's browser. This issue has been patched in version 1.2.27.

Why it matters now

EPSS 0.01481 74th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed cacti (Cacti): 1.2.27

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Cacticactibefore 1.2.271.2.27Patch availableCNA
  • cacti VendorCacti Affected before 1.2.27 Fixed in 1.2.27 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:cacti:cacti:1.2.25:*:*:*:*:*:*:*1.2.25VulnerableCacti
  • cpe:2.3:a:cacti:cacti:1.2.25:*:*:*:*:*:*:* Versions 1.2.25 Vulnerable ·Cacti

Remediation

  • Fix · CNA cacti (Cacti) Fixed in 1.2.27

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-49086

References

Exploit 1

Patch 1

Other 1

  • TI-2022-22813 Unauthenticated command injection in cacti KEVCVSS 3.1CRITICAL 9.8
  • TI-2023-20500 Unauthenticated SQL Injection in graph_view.php in Cacti CVSS 3.1CRITICAL 9.8
  • TI-2024-16869 Cacti RCE vulnerability when importing packages CVSS 3.1CRITICAL 9.1
  • TI-2024-20809 SQL Injection vulnerability in automation_get_new_graphs_sql CVSS 3.1HIGH 8.8
  • TI-2023-26750 Cacti SQL Injection vulnerability CVSS 3.1HIGH 8.8
  • TI-2025-18110 Cacti allows Arbitrary File Creation leading to RCE CVSS 4.0HIGH 8.7
See all 151 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences