Cacti CVE-2026-71287

Exploitation requires a valid Cacti user account of any privilege level - the CVSS vector PR:L confirms low-privileged authentication is sufficient, and the description explicitly states 'any authenticated Cacti user, regardless of privilege level.' The attacker must be able to send HTTP GET requests to at least one of the four confirmed affected endpoints: user_log.php, utilities.php, user_domains.php, or user_group_admin.php, all of which expose the sort_column parameter. No special Cacti role, administrative access, or non-default configuration is required. Exploitation is limited by the requirement of a valid session - unauthenticated actors cannot reach the vulnerable code path. Time-based blind injection is also slower than direct extraction methods, meaning automated extraction of large datasets requires sustained access and generates observable database load and HTTP traffic patterns that may be detected by monitoring.

The CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately reflects the network-accessible, low-complexity, low-privilege nature of this flaw. Any user account - including read-only or guest-level accounts - is sufficient for exploitation, substantially widening the attacker pool relative to admin-only flaws. The attack is fully unauthenticated from a network perspective (a session cookie is required, but no elevated role). Time-based blind injection is slower than error-based or UNION-based methods but reliably extracts data and does not require any special database error configuration. No EPSS score was provided in the source data, preventing quantitative comparison; however, the low-complexity, network-accessible, widely-understood technique class (ORDER BY SQLi) historically correlates with rapid weaponization once disclosed. No CISA KEV listing is present, and no POC has been identified at time of analysis. The primary real-world risk is credential harvesting from the Cacti database (hashed passwords, SNMP community strings, device credentials) leading to lateral movement within the monitored network infrastructure.

An authenticated Cacti user - for example, a read-only NOC operator - navigates to user_log.php?sort_column=SLEEP(5) or sends an equivalent crafted GET request, causing the MySQL server to delay its response by five seconds per injected condition. By varying the delay condition (e.g., IF(SUBSTRING(password,1,1)=0x61,SLEEP(5),0)) and measuring response times, the attacker iterates character by character to extract password hashes, SNMP community strings, and device credentials stored in the Cacti database. No public proof-of-concept code has been identified at time of analysis, but the technique is a well-documented class requiring only a browser or curl.