Back Sploitus

CVE-2022

Sploitus • November 14, 2026

# Cacti remote_agent.php Remote Command Execution Vulnerability CVE-2022-46169

Cacti is a server monitoring and management platform. A command injection vulnerability exists in versions 1.2.17 to 1.2.22. An attacker can bypass server-side validation via the X-Forwarded-For request header and execute arbitrary commands.

![J4%C_K RW2 KPS`T2B{39JT](

![J\)8}@3I3VQ86W\(WN` P1$LY](

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical RCE Vulnerability in Cacti Exploited CVE-2022-46169 is a critical vulnerability in Cacti versions ≤ 1.2.22, allowing unauthenticated remote code execution. Attackers can exploit this flaw by sending a specially crafted HTTP request to the `remote_agent.php` file, bypassing authentication through a forged `X-Forwarded-For` header. The vulnerability results from improper handling of the `poller_id` parameter, enabling command injection. This flaw affects any Cacti installation accessible over the internet, making it a significant risk for organizations using this platform. The vulnerability was published on December 5, 2022, and has been since its addition to the CISA KEV list on February 16, 2023. A proof-of-concept (PoC) was made public shortly after its disclosure, increasing the risk of exploitation. Organizations are urged to patch their systems to mitigate this threat. 3 sources 73

Extracted Entities

CVE-2022

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

CWE Weaknesses (1)

MITRE ATT&CK (1)